Wednesday 9 September, in the clear, on Bitcoin. The group that called itself white hat writes that Blockstream put only $1.5 million, “maybe even 0”, to secure $5 billion of assets. Then: “You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss.” A relay of that text is on X. The $1.5m and the $5bn are the group’s accusation. Not a Blockstream figure. We do not take them as facts.

We already held the thread. On 6 September, an Elements bug let someone create about 4,000 L-BTC with no deposit. Peg-out. Nearly 3,996 bitcoin out. On the 7th, 3,400 came back. 598.5 remain. This is not Layer 1. SideSwap, on the 9th: no SideSwap key, wallet or system compromised. Today’s message does not invent a second theft. It puts a price, and a threat, on what is still elsewhere.

This is straight extortion. This is not how security work is done. […] Any other behavior is extortion.— Charles Guillemet, Ledger CTO, 8 September 2026

10%, 15%, of what

Bitquery notes that 15% matches the share still held: 598.5 of ~4,000. 10%, read against that, would be about 400 bitcoin. The same text says: the message does not say 10% of what. We hold the ambiguity. Bitcoin.com carries the demand and the threatened holder loss. End of the message, still in the clear: the group will “publish the privatekey to decrypt our conversations afterwards.” The encrypted exchanges, if they exist, have not been published here. We do not invent them.

Guillemet, the day before, refused the word: a researcher contacts the team, Blockstream decides, a bounty maybe. Anything else, he says, is extortion. We quote. We do not sit as a court. The episode is not closed. Not a sentence. Not a recovery of the 598.5. Not a public bounty deal signed by Blockstream, as we write.

On the 6th, SideSwap processed the peg-out as a customer order. 0.1% fee, about 4 bitcoin. SideSwap says it returned them to the federation, tx `0334e463…8a1f`. Bridge cut around 20:25 UTC. Guillemet, on the evening of the 6th, wrote: “White hats don't drain a bridge and then solicit an on-chain contact.” On the 8th, he calls it: extortion. On the 9th, the group still speaks in the clear. We line up the dates. We do not line up a verdict.

What 9 September holds

  • Held: plaintext, 9 Sept., 10% “using your own money” or 15% loss; $1.5m / $5bn = the group’s claim; 3,400 back, 598.5 elsewhere; Elements bug, not Layer 1; Guillemet, extortion, 8 Sept.; SideSwap: not its keys.
  • Not held: that Blockstream paid. That $5bn is audited AUM. 10% of what, in the words. The conversation key, published. A white hat on the record. Advice to buy or sell L-BTC.

Sources: Bitquery, Bitcoin.com, X / PreRichBear, Guillemet, SideSwap, 9 Sept.. Nothing here is investment advice.