Seem the Battle Negotiation between Hacker & Blockstream is currently getting a bit tense.

Previously, we know the hacker made a bold statement.

• Criticize how Liquid Network/Blockstream secured their asset
• Impressed by the incompetence of their team for the security they created
• Bad management move by the team
• Planning to make every conversation public

This time, Blockstream is the one who makes a firm action for the response criticize they're receive.

• They will not pay a ransom
• Make a statement for the Bitcoin community
• Demanding for the one who holds the stolen coin to return the rest

Source

Making a statsment like these after receive a refund 3,400 BTC is wild.

This is not being a whitehat, this is direct attack on Liquid's reputation. Good folks would silently approach and initiate a conversation in private. Let's see what happens to the hacked service(s) after this.

I hope they are not expecting a reward as a fee for ruining their reputation and future credibility.

The chance that they are white hats at all is about zero at this point but at the same time, Blockstream is just as stupid for pretty much blocking any possible positive out come by releasing that statement.  If I thought there was a chance they would get the 'white hats' to refund at least part of what they had left, now I believe the chance is exactly zero.

Now that you mention it, isn’t Blockchair based in Russia? I don’t think they would survive a hack of this magnitude.

Then again, they aren’t running a sidechain.

The only reason Blockstream hasn’t gone under yet is because the main guys involved in it are early Bitcoiners and therefore have many hundred BTC to bankroll the company in addition to investors.

So keeping that in mind, I think they gave too little attention to bug bounty programs. It simply doesn’t work with AI being so accessible nowadays.

We can agree the companies can and do have terrible policies or a lack thereof, but what about that? Is every company supposed to have that simply because that is the optimal configuration? Of course not, we are not demanding optimal behavior from practically any company with anything. Furthermore, should someone who discovers a security exploit be allowed to demand anything from that company? Whether for them to change their policies or a ransom? That is neither the case. They should improve their policies, but that is not directly relevant to the unresolved case here.

It depends a lot on what kind of personality you have and what kind of approach you usually take with these things. I would also not provide a "THANK YOU" to someone who is trying to ransom money from me knowing that the only reason for which they returned the other part of it was because they believe that they can get away with this legally. In the end, who decides what the payout is supposed to be for an exploit if you are a "white hat hacker"? The company in question.

Therefore, even in the case of a catastrophic bug such as this one the company can decide that it is worth $500 to them and pay this out. Would that make it a shitty company? It would, but that does not change the fact that the authority to decide the payout solely rests with them. A real white hat would take the money (or outright refuse it if it is insulting) and complain, but he would move on. Bad people would try to do all sorts of things, such as the ransom attempt here. So FUCK THEM, they don't deserve a "THANK YOU". That's more my style, that's why it resonates with me.

This is what I expected every hackers to do, find vulnerabilities and get paid doing so, but the bad ones will prefer to run away with all the bags, even if Whitehats decided to take 10 BTC the owner will still feel good about it.

10 BTC or 4000 BTC, just like I talked to a friend sometime ago, three weeks now, he said finding vulnerability isn't easy and the problem is the victim would rather say thank you even though they have the money to  settle you they won't.

Just a thank you and tell you to move on, some big companies do the same too, and I replied him with " take your price once you find the vulnerability, even if you get sued your price which must be reasonable will set you free.