Well, the op-return dialog between the liquid hacker and blockstream got a little more interesting a few blocks ago:
This comes after the hacker stated that all communication would be plaintext yesterday.
pull down to refresh
pull down to refresh
Well, the op-return dialog between the liquid hacker and blockstream got a little more interesting a few blocks ago:
This comes after the hacker stated that all communication would be plaintext yesterday.
"I'm a whitehat"
"You are going to pay 10%"
lmao
A very self-righteous hacker.
Where I'm from, the moment you extort, you're a blackhat.
Edit: PS. "From now on everything is in cleartext" is also extortion, so that's 3 counts.
I'm surprised the hacker thinks this is a viable way to proceed.
Steal some funds if that is what you are going to do, but this kind of "negotiation" is clearly never going to lead to some sort of consensual ending. Hacker has an ego?
Concur.
An uncontrollable ego at that. Anyone that uses OP_RETURN for things like this has issues.
Or it is some kind of personal beef.
<they're the same picture meme>if they think the FBI isn’t watching this convo like a hawk they’re also delusional. the longer it goes on, the more it helps them find them. the FBI would absolutely reject paying the ransom.
they should upload a jpeg in response
What he meant by "I am a whitehat"
I think Blockstream should def pay some percentage, one way or the other. See also #1566044. I guess I’m not a whitehat.
I guess not indeed. They're declining a $1.5M bounty, which would be a top 10 (3?) all-time bounty payout across everything that ever was coded in the history of mankind. 10% makes it the top1 by 3.2x, because currently the biggest bounty ever was $10M for a responsibly disclosed wormhole vuln.
As I read it, Blockstream wants everything back and is thus not willing to pay anything. Is that a wrong interpretation of the situation?
Wrong interpretation. You should always put everything back and get the bounty paid with non-stolen funds. The 1.5M is the bounty offered, I'm 99% sure. So "they're not willing to pay anything" is a bad assumption on your part, I think.
He doesn't want to give everything back hoping to get something in return because he doesn't want to trust, he wants to verify 😅
The “(maybe even 0)” made it sound like it might not be a bad assumption.
That refers to them not having received it yet? I wouldn't pay squat to anyone holding 15% of funds hostage either.
As little as 3 months ago my former security list got blackmailed for 500k USDC including ethereum address. And that was one of countless. So I guess I am biased.
The hacker is afraid that they won't pay him the bounty if he releases he remaining coins.
1.5 million for 5 billion assets is kinda 0 in hacker's eyes. Because he isn't sure...maybe the blockstream guys indicated something to him with disrespect.
Hacker must be from India?
100% this is the interpretation
Actually as I can interpret, the hacker is asking that he should be paid 10% of the funds out of thier own money (not from the users funds), he also means if they fulfill this, the users will not lose 15% ...this also means hell refund the remaining.
Probably this proposition is because the whitehat hacker wants clean funds.
Stop calling it a whitehat. You're not a whitehat if you extort. Whitehats return the funds and get nothing.
there are no whitehats in India
Greyhat seems appropriate here, a blackhat wouldn't have returned anything or made contact.
Still violated security.md though
deleted by author
> conversations get decrypted
> em dashes used liberally in the exchanges
Make it happen
i would chuckle
my favorite OP_RETURN message from this debacle
So it WAS you! I knew it
deleted by author
Oh, now this is getting fun! 🍿
Only now? I’ve already gone through like five buckets of popcorn since the start!
My 100x leveraged long popcorn is very disappointed in your volume.
riiiiiight!
No signature so anybody could have posted that.
But Blockstream would know if this is where the conversation is at if they've already received the same thing signed and encrypted to them.
It is an op-return included with a transaction moving the stolen funds. Isn't that evidence enough of who sent it? Or am I missing something here?
Does this mean they going to return the outstanding 5%
I don't think so. I don't know if Block stream is going to pony up 10%.
I thought they withheld 15 already. They want more?
The way I read it is that perhaps they have offered to return 5% more (leaving the amount they take at 10%) if Blockstream moves amount equal to 10% to the liquid federation address.
ie the hacker is demanding that Blockstream contribute at least 10% to making the liquid network whole, and the attacker has withheld an extra 5% to try to force them to do this.
Seems like the person has quite a chip on their shoulder regarding Blockstream...
My guess - a BIP- 110er with anger towards Back.
oh, that'd be fantaaaastic!
True, Luke the holy scammer has been quiet for a while
So maybe they eventually settle for a 200 BTC bounty
Spamming the chain with OP_RETURN? Totally tracks, they're really good at saying one thing while doing another.
I DESERVE PAYMENT FOR MY WORK!!
I'm rooting for the hacker at this point...
I was so surprised to hear so many bitcoiners this week making endless excuses for Blockstream. “They’re such good people, yada yada…”
Maybe its because I've never interacted with a blocksteam employee (knowingly), but I tend to judge a company based on their work and products alone.
First PeerSwap has a ton of vulns patched, then CLN, now LBTC
Three failures in three separate products is a pattern worth discussing, diagnosing, and destroying the underlying conditions that led to this.
Our legal system does not hold Blockstream accountable, so the "free market" gave us the vigilante we needed.
What a mess...
Hard to see how this resolves any better than what Liquid already got back.
Spicy.
I think, yes we all can agree that liquid whitehat is way better than blockstream.
There's definitely lot on the conversation that will particularly rug the whatever repo blockstream and Adam are left after the incident.
I read this plain text as now holding the conversation key ransom.
I wonder to what extent Blockstream thought they were having an encrypted conversation, and are now realizing that everyone might read what they wrote to this group.
It's possible those contents make this look much much worse, might not just be the death of Liquid but Blockstream itself as it's currently structured.