Blockstream Admits Code Is Not Law After 598 BTC Theft
A software bug allowed the minting of 3,998.5 L-BTC. 598.5 BTC remain stolen as Blockstream invokes legal recourse.
598.5 BTC remain unrecovered following a bug in Blockstream’s Elements node. The flaw allowed the creation of 3,998.5 L-BTC with no underlying asset. This event occurred on September 6, 2026. The attacker converted 3,996 BTC into fiat currency. The value of the stolen funds was approximately $47 million.
Blockstream published a letter on September 11 refusing a bug bounty. The company labeled the act as theft rather than white-hat disclosure. Samson Mow, chief of JAN3, stated on September 15 that code is not law. This marks a shift from the traditional
The Liquid Sidechain Incident
The exploit began at 13:53 UTC on September 6. A range-proof cache bug in the Elements software was triggered. The attacker minted roughly 3,998.5 L-BTC. Thirteen minutes later, 4,000 L-BTC were sent to a peg-out service. By 14:28, the Federation paid out 3,996.018 BTC. The total value was approximately $320 million.
The security fix had been merged into the codebase two days prior. The update was not deployed to the live network. Blockstream’s incident report stated the peg-out mechanism operated as designed. The attacker left an OP_RETURN message claiming white-hat status. By September 7, 3,400 BTC had been returned. The remaining 598.5 BTC were withheld pending a 10% bounty.
Legal Recourse Over Code
Blockstream’s September 11 letter cited criminal law. The document stated that unauthorized asset retention is theft. The company pledged to work with law enforcement. It also named exchanges and forensic specialists as partners. This approach contrasts with the
Samson Mow responded to user queries on September 15. He confirmed that code does not equate to law. Mow noted that the system failed due to a code flaw. He argued that legal mechanisms must govern digital asset recovery. The company has not built a mechanism for on-chain court order execution.
Recovery Mechanisms Remain Absent
Bitcoin lacks a native method for judicial asset seizure. On the Liquid sidechain, recovery relies on manual intervention. Blockstream currently manages recovery through off-chain letters. No automated protocol exists to enforce court orders on-chain. The 598.5 BTC remain in limbo. The incident highlights the gap between legal authority and technical implementation.
