Aaand got a phishing email, subject "Liquid Network: Action Required to Update Security" - reported to Amazon via SpamCop & Cloudflare doesn't accept phishing reports via SpamCop.

No, not at all. These hackers are far from white hats. Even if I'll classify them from a moral standpoint, based on the fact that they returned parts of the moved funds and are still in negotiations to possibly return the rest, I'll call them gray hats. Gray hats are the hackers who independently test systems without authorization and seek settlement to effectively communicate loopholes, still gray hats don't take advantage of the system, but these self-acclaimed white hats made away with some come already.

Someone just created a messenger visual for the communication between Blockstream X Team Liquid and The Hacker. These should be easy to be follow for everyone who are interested enough for following their communication on-chain.

• Messenger Visual
• Information about the hacker
• Integrated with Mempools
• Every message are link with the hash transaction
• Official update from Liquid Network is also being inclueded on these tools

Death sentence is wasting resources, A black hat who has been apprehended should be reintegrated to protect what he has previously exploited as a form of punishment, that's a better reward to the society and put their experience to good use. Non-ethical hackers can be reprogrammed to ethical hackers if appreciated enough and under close supervision.

This is true, most of them venture into black hats for survival since they're not appreciated enough, but doing something wrong can never be justified. I have a good deal of them as colleagues in my line of work. It's not only them, a lot of us tech bros are greatly underappreciated and it can be tempting to veer off the fraudulent side of things when you have such abilities, especially as the bad players can pay any amount to get the jobs done.

The truth is that the whistleblower or mastermind in Liquid's case might have been an underappreciated White hat hacker that works within the system. Maybe he just took the opportunity to appreciate himself as he wants.

Deserved? This could be some newbies using AI tools to scan software that is likely going to lead to good financial gain, what part of this indicates that it was deserved?  Prison time is deserved, everything else is your own fairy tale.

It is a black hat operation, nothing else and nothing more. Giving back some of the money does not make it into something that it is not.

Correct. The consequence of actually being good is that in some cases the payment may never arrive, in others it will be extremely delayed and in some others it will be very little compared to what was actually accomplished. Yet, good people accept these consequences willingly. They do not feel entitled to anything, they do not pretend to be the good guys, and so on.

The negotiations are still in there, everyone. Look what the hacker said. Seems he's very disappointed right now.


Hash TX: https://mempool.space/tx/f7055f6c8dd00f404e48c12483ae740180f658db206733505bb27b015e579588

What do you think about these ? I guess soon we are going to see more and more messages on-chain without encryption since he will publish the private key to decrypt the message encrypted being sent by Blockstream.

It seems that they are been held as hostage by those hackers claiming to be a whitehat.

If they don't have any bad intention, then why it seems that they are forcing the company to pay them from the hacking incident happened and also for exposing those exploits?

Curious to know on where this case ends up. It seems the hacker is eager to get their rewards and will do lots of crazy things to convince the affected platform to give what they want.

I'm not in the security research and white hat hacker business. Because I'm interested in all sorts of IT security and exploit stuff, I've seen some cases where white hat hackers have been blatantly screwed up, from the limited public looks of it, so alledgedly, by small or large companies which don't quite acknowledge the work those white hats invest.

I can't still make up my mind on this current case, because too little of the actual exploit is public so far. I don't defend how the, more likely grey or blackish hat, hacker acted with this case. It's certainly different compared to what one is used to.

If Blockstream and Liquid network had a clear (and fair!) bug bounty program in place, a white hat hacker would be bound to its terms. Now what do you do, when the bug bounty is maybe ridiculously meager compared to possible damage of some vulnerability (how complex it might be)? You wanna still play by the book? Sure, would be better, but what if you don't want to be fucked by some arrogant company who doesn't quite want to acknowledge their vulnerabilities' scope and pay you what you as a security researcher might deserve to get?

Again, there's too little details published to judge the case properly in my opinion. Maybe the current exploiter is too greedy, maybe he's not and the amount they currently take hostage would be totally fair, depending on how serious the flaw they exploited actually is (looks serious enough to me). If this prevented a much larger potential damage by real criminals (who don't return ~85% of the heist, btw), then what?

Does anybody here believe Blockstream/Liquid would've offered a generous 15% or 10% or even 5% bug bounty for a potential damage of 4k BTC stolen by a real criminal? If they had pegged more BTC which could've been stolen, then again what?

I'm very interested to read the full post-mortem, especially why the attacker is considerably disappointed by Blockstream's/Liquid's side of actions. Don't misinterpret me, if I sound a bit sympathetic to the exploiter. Big companies produce in many times some shitty code to do their business. Many outsource the security and vulnerability research to hopefully white hats, it's a valid business model, although I would argue, that focusing on better and more secure software design and coding in the first place would be nice, too. I guess it's a race companies can't win. A white hat or malicious actor has all the time to find exploits while a company can't have all the time to think about possible flaws and exploits. And yeah, complex software is never free of flaws because the shit has to hit the market as soon as possible.

Blockstream can certainly pay for that. They received more than 600m funding and they are worth about 3 billion

https://www.quantumrun.com/consulting/blockstream-net-worth/

I think the main problem is that the company didn't had an active bug bounty like other companies. And according to the hacker they didnt invest in security (which looks to be true)

now the hacker found a critical bug. He is asking for 30million dollars, which is quite high for any bug bounty...

i've been following this drama here and on social media, and i'm really amazed at how Blockstream has been communicating with the white-hat hackers!
to help understand the whole Liquid hack, i've uploaded a few images here so we can visualize the situation a bit better and maybe understand it more clearly that way


https://x.com/Bitcoin_Devs