What Counts as a Whitehat

On November 3, the Liquid Federation announced it had restored 1:1 BTC backing for L-BTC. This comes almost two months after an exploit drained Liquid Network reserves for 4,000 BTC out of a total of 4,205 BTC. Exploiters ultimately returned 85% of funds, keeping a “bounty” of roughly 598.5 BTC or $47M at the time of the exploit for themselves.

Although Liquid Network assets have since regained parity, it’s unclear where the remaining funds came from. The $320M exploit, until then the largest of 2026, is a reminder for both teams and researchers of what makes a whitehat: it’s not the 10% fee, but how the rescue happens. This is determined before any funds move, with rescue terms set ahead of an exploit, by the project.

How the exploit turned into a bounty

On September 6, 2026, a vulnerability in Liquid Network, the Bitcoin sidechain run by Blockstream, was used to take roughly 4,000 BTC from Liquid’s reserves. Liquid's software cached range-proof checks in a way that invalid data could point to an earlier valid result, so nodes accepted L-BTC with no real bitcoin behind it. The attackers then swapped that unbacked L-BTC for real BTC from the network's reserve.

Attackers communicated with Blockstream through messages embedded in Bitcoin transactions, most of them encrypted. One plaintext message warned that "the chain is under risk at latest commit." After Blockstream patched its nodes, about 3,400 BTC, roughly 85% of what was taken, came back on September 7. The remainder was held hostage for a “bug bounty”.

Two days later, the attackers asked for a 10% "bug bounty" in another onchain message: "You SHALL pay 10% using your own money." Blockstream refused on September 11. "It is not white-hat activity. It is theft," the company said, adding that it would not pay for the return of stolen property.

Setting aside legal and moral considerations, the first two lines of the attackers’ message point to a real cybersecurity issue: what is the due process, and what is fair compensation for whitehats?

More recently, a researcher was faced with a similar issue. They had found a weakness in a Base vault, but there was nowhere to report it. A week later, on October 4, the vault was exploited for about $6 million in wstETH. Seven Safe signers remained unidentified, with no public team response more than 24 hours later.

"Considering this is an unidentified vault, a whitehat can hardly perform any action with guarantee not to leave them in legal trouble," said Gonçalo Magalhães, Immunefi’s head of security. "A bug bounty could definitely have stopped this attack, since it's probable the security community would have found this flaring problem in the smart contract."

The risk of "return most, keep some"

The 10% bug bounty cost didn’t start with Liquid. In August 2022, a bug in the Nomad bridge let anyone copy the original attacker's transaction, swap in their own address, and withdraw funds. Hundreds of addresses did it, and more than $190 million left the bridge within hours.

Nomad answered with a public offer. Anyone who returned at least 90% of what they took would be treated as a whitehat, could keep the rest, and would not face legal action from Nomad. More than 40 addresses sent back over $36 million. It helped them recover what would otherwise be sunk cost, but also set a precedent.

Going forward, 10% became the standard price to restore protocol security. Although the amount is preferable to a full loss, the method is what defines a rescue. If the expected behavior is for a hacker to drain funds first and return them afterwards, what should be a rescue can quickly become extortion, and the price is set by the attacker.

"Rescue terms must exist ahead of an exploit. All serious protocols should set these in advance," said Mitchell Amador, Immunefi’s CEO.

Kraken saw this in June 2024, when a researcher at a security firm found a bug that let accounts be credited with deposits that never arrived. The researcher credited their account with $4 to prove the flaw and filed a bounty report. According to Kraken, the researcher worked with people who then withdrew nearly $3 million and would not return it until Kraken said how large the exploit could have been. The firm disputed Kraken's account of events.

When there are no clear terms of engagement, the cost of a hack can go anywhere from full loss to a painful haircut, and this is even worse for DeFi platforms where margins are thinner and where security reserves are a luxury. When most of a protocol’s funds belong to users, they bear the painful brunt of exploits.

What makes a whitehat

The definition that bug bounty programs work from is simple. A whitehat finds a vulnerability, reports it privately, gives the project time to fix it, leaves user funds alone, and gets paid through a process both sides agreed to in advance.

"Coordinated disclosure ends the moment you set the terms yourself. The money was never yours to save, so moving it is not a rescue," said Mitchell Amador, Immunefi’s CEO. "Keep a dollar of user funds, and it is theft, whatever the intent was at the outset. The path for a researcher is private disclosure, ideally within a well-defined program."

Although the industry's own safe harbor framework also pays around 10%, it’s not the price that separates a whitehat job from an exploit, but the process. The Security Alliance (SEAL) Safe Harbor terms establish consent prior to the attack, allow whitehats to move funds only once a third party has begun an exploit, moving them exclusively to an address the protocol controls, with a fixed reward and cap.

Immunefi provides a responsible setup for expanding bug bounty programs to include Safe Harbor, which uses a more legally strict form of the Security Alliance's Safe Harbor Agreement on top of its existing bug bounty dashboard and emergency alerting infrastructure.

The track record shows this works. Immunefi had paid $144.7 million to whitehats as of September 30, 2026, including $18.4 million in 2026. One of the best-known payouts went to a researcher known as satya0x, who received $10 million from Wormhole in 2022 for reporting a critical bug in its Ethereum bridge contract. Wormhole fixed it before anyone could exploit it.

The process isn't perfect. Some projects are slow to respond, teams sometimes rate a bug as less severe than the researcher believes, and rewards can be lower than expected. When that happens, Immunefi mediates between the researcher and the project and pushes for an outcome that matches the program's published rules. A slow or disputed payout is a risk, but the alternative is operating under a gray zone, holding user funds and hoping the project accepts terms and doesn’t pursue legal action.

"Ten percent of a $100M exploit is $10M earned legally, with nobody hunting you afterwards. The alternative for them is moving nine figures onchain while every forensics firm watches," Mitchell added.

For protocol teams, the lesson is to set the terms before anyone else does. A bug bounty program gives researchers a clear, paid path to report vulnerabilities privately, and teams a transparent cost for security. Safe Harbor gives whitehats rules to follow if a live attack happens. As of November 9, 155 live bug bounty programs run on Immunefi. To set up yours, start at immunefi.com/projects/get-started.