Immunefi founder and CEO Mitchell Amador said the unidentified actors behind the Liquid Network exploit lost any claim to white-hat status after retaining 598.5 BTC from roughly 4,000 BTC taken in the incident. The attackers returned 3,400 BTC after Blockstream patched affected bridge nodes, but Blockstream rejected their demand for a 10% bounty and said it would not pay for the remaining Bitcoin. Amador said coordinated disclosure ends when a researcher moves user assets without authorization and later sets payment terms. He urged protocols to establish rescue procedures, disclosure requirements, legal protections and bounty limits before an exploit occurs. Immunefi’s Whitehat Safe Harbor framework was developed to define those conditions in advance. A technical review found that a cache-key collision in confidential transaction verification allowed the creation of unbacked L-BTC, which the actors converted into real Bitcoin through SideSwap’s peg-out service. Blockstream said federation keys were not compromised. Amador defended a preapproved bounty of up to 10% of funds at risk, subject to an affordable cap, while noting that protocols can approve larger payments at their discretion. The case also highlights criminal exposure for unauthorized exploits: former security engineer Shakeeb Ahmed pleaded guilty in December 2023, was sentenced to three years in prison in April 2024, and was ordered to forfeit stolen assets after attacks on two decentralized exchanges.