Bitcoin Magazine

Blockstream Tells Hackers To Return Remaining Bitcoin Stolen in Liquid Theft

Bitcoin infrastructure firm Blockstream has refused to negotiate further with hackers who last week stole 4,000 bitcoins from its Liquid network. 

Writing on X Friday, Blockstream said that the hackers still had time to return the funds before the company would work with law enforcement. 

White-hat hackers on Sunday withdrew about $320 million from the federation wallet that backs Liquid, a sidechain by Blockstream. After negotiating with Blockstream, they returned most of the funds but kept 598.5 coins worth over $46 million — demanding it as ransom. 

“Blockstream will not pay a ransom for the return of stolen funds,” the post read. “Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.”

To those responsible for the theft of bitcoin from the Liquid Network:

Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is…

— Blockstream (@Blockstream) September 11, 2026

It added: “We will work with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible.”

“We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds.”

Liquid, or L-BTC, is a layer-2 created by Blockstream that allows users to fast move assets backed 1:1 with bitcoin. One of the assets, LBTC, is a token backed by bitcoin that allows for quick settlement — a bit like the Lightning Network. 

Hackers were able to get the funds by exploiting an inflation bug on the Liquid sidechain to create over 4,000 LBTC that did not exist before and cash them out for real, on-chain bitcoins. 

The hackers then had an exchange with Blockstream via messages written into Bitcoin blocks. 

In one message, the white hats wrote: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”

In the latest message, the hackers slammed Blocksteam as “delusional, greedy, and arrogant,” and threatened to reveal all of Blockstream’s encrypted messages in the exchange unless the company allowed thieves to keep 10% of the bitcoins. 

“You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess,” the message read. 

The Bitcoin community is still reeling after hackers in July were able to steal over 1,800 bitcoins worth close to $140 million from Coldcard wallet holders. 

Users of the popular hardware wallet, created by Coinkite, were targeted because the product’s manufacturer did not use a true random number generator, allowing hackers to essentially guess investor seedphrases. 

This post Blockstream Tells Hackers To Return Remaining Bitcoin Stolen in Liquid Theft first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Ringleader of $245M Crypto Theft Pleads Guilty 

The man behind one of the biggest bitcoin thefts in history this week pleaded guilty.

Malone Lam, 22, a Miami resident from Singapore, on Tuesday admitted his role as ringleader of the international crime group which stole 4,100 bitcoins — worth over $230 million at the time — to fund a life of luxury. 

The U.S. Department of Justice said that from October 2023 and through at least May 2025, Lam and others hacked databases to steal crypto users’ information and con them into providing user logins and private keys. Bitcoin and other cryptocurrencies worth $245 million were taken in the theft. 

On one occasion, a co-defendant broke into a residence in New Mexico and stole a hardware wallet while Lam monitored the victim’s movements by hacking their iCloud account.

“This defendant led an international network that preyed on victims through deception, invaded their privacy, and stole hundreds of millions of dollars in cryptocurrency,” U.S. Attorney Jeanine Ferris Pirro said in a statement. 

“If you build a cybercrime empire, we will find you, dismantle your operation, and hold you accountable,” Attorney Pirro added. 

The DOJ said: “The Racketeer Influenced and Corrupt Organizations Act conspiracy used social engineering and occasional home break-ins to obtain information that allowed the conspirators to drain their victims’ cryptocurrency wallets.” 

The crimes started after a group of online gamers became friends before working together to commit the cybercrimes, the indictment read.

Lam and co-defendants laundered the stolen bitcoin and spent it on bottle service parties, private jet rentals, security guards, luxury handbags and watches, and properties in Los Angeles, the Hamptons, and Miami. 

The defendants would spend up to $500,000 a night on parties and give away designer handbags worth tens of thousands of dollars, Tuesday’s announcement read. 

Lam was arrested in 2024 at his rental home in Miami. 

This post Ringleader of $245M Crypto Theft Pleads Guilty  first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Japanese Bitcoin Industry Unveils ‘Aurora’ to Let Global Anime Fans Support $2 Trillion Yen Space

Japan Bitcoin Industry Co., Ltd. has debuted a self-custodial Bitcoin payments platform designed to help Japanese companies sell to international fans who are often shut out by traditional payment systems.

Using this week’s Bitcoin Asia conference in Hong Kong to introduce the product, JPI dropped Aurora — aiming to reach an audience that could not be serviced before. 

The pitch is simple: anime, manga, games, and other Japanese content have a massive global following, but the payment rails supporting that content haven’t kept pace. 

香港で開催中のbitcoinasiaに当社取締役の加藤( @btc_dakara ) が登壇します。ビットコインとステーブルコインの関係について登壇者の方々とお話しいたします。 https://t.co/8e1aKAvjgv

— 日本ビットコイン産業株式会社 (@JBIinc_bitcoin) August 27, 2026

Aurora aims to close that gap by letting international customers pay in Bitcoin over the Lightning Network, while giving Japanese merchants a simple point-of-sale and API layer to manage invoicing, payment tracking, and integrations.

According to JBI, the market for Japanese anime content outside Japan reached ¥2.17 trillion in 2024, up 26% year-over-year — yet many overseas fans still struggle to pay for streaming subscriptions, digital merchandise and limited-access drops due to geographic payment restrictions.

The platform’s core design principle is that JBI never touches the money. Each merchant runs its own self-custodial Lightning node, receiving Bitcoin directly from customers. 

JBI says this setup gives businesses cleaner regulatory footing, since the company isn’t acting as a custodian, while still handling the harder operational lift — node uptime, liquidity, accounting and auditing, and conversion to fiat — that has historically kept enterprises from adopting Bitcoin payments on their own.

JBI says aurora draws on lessons from its existing consumer business, UseBitcoin.jp, which has let customers buy digital gift cards — including au PAY, V-Preca and Kyash cards — using Lightning payments for the past two years.

The company is inviting media, prospective merchants and wallet providers to connect with the team at Bitcoin Asia 2026 in Hong Kong.

This post Japanese Bitcoin Industry Unveils ‘Aurora’ to Let Global Anime Fans Support $2 Trillion Yen Space first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Bitcoiners Warned After French Tax Authority Confirms Data Breach Affecting Hundreds of Thousands

Bitcoiners have been warned after France’s tax administration confirmed that hackers breached its information system, exposing sensitive financial and personal data belonging to hundreds of thousands of taxpayers and businesses.

Writing on X on Friday, Bitcoin developer Jameson Lopp said the leak was “more bad news for Bitcoiners living in the leading country for wrench attacks.”

Lopp has created a tracker counting wrench attacks — when physical violence is used to steal crypto — across the world. A large amount happens in France, where data has been leaked before. 

More bad news for Bitcoiners living in the leading country for wrench attacks. The French tax authority has been hacked and 678K records leaked.

26,805 people with income over 100K€
386 people with income over 1M€
8 people with income over 10M€https://t.co/KlT0XqPLFR

— Jameson Lopp (@lopp) August 14, 2026

The news comes one day after hardware wallet manufacturer Trezor announced a data breach exposing customer data. 

Cybersecurity researchers at FrenchBreaches, who reviewed samples of the leaked data, reported that the affected records break down to roughly 392,867 individuals and 285,570 businesses. 

Among the individuals, an estimated 26,805 have a reported annual taxable income of €100,000 or more, 386 exceed €1 million, and eight exceed €10 million. The hacker is said to be offering the full dataset for sale for several thousand euros.

The breach first surfaced publicly on August 12, when a hacker using the alias “ZeroBytes” posted on a cybercrime forum claiming to have infiltrated internal DGFiP servers and obtained VPN credentials that unlocked an internal lookup tool covering millions of taxpayers. 

According to the hacker’s own account, the extraction was interrupted before it could be completed, leaving what they described as only a partial dataset of 678,438 records.

The exposed sample reportedly includes highly sensitive information: full legal names, dates and places of birth, home and mailing addresses, marital status, number of dependents, internal tax identification numbers, reference taxable income, individual withholding tax rates, phone numbers, email addresses, and records of past correspondence with tax officials.

Security analysts warn that this combination of identity, contact and financial data could fuel highly convincing phishing campaigns impersonating tax authorities, as well as identity theft and fraud schemes tailored to victims’ income levels or family circumstances.

2025 was the worst on record for wrench attacks (crypto targeted kidnappings), with around 55 reported globally last year, according to TRM Labs. Lopp’s tool counted over 70 throughout last year. And this year is already looking bad, according to the tracker: 54 attacks have been documented so far. 

Wrench attacks made headlines last year when crooks kidnapped David Balland, co-founder of crypto hardware wallet brand Ledger, and his wife in France.

Criminals held the pair for around 24 hours before they were rescued by the French authorities.

This post Bitcoiners Warned After French Tax Authority Confirms Data Breach Affecting Hundreds of Thousands first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

FBI Agent Accused of $1 Million Crypto Theft From ‘Adversarial Nation’ 

A Federal Bureau of Investigation agent allegedly took $1 million in seized cryptocurrencies before turning himself in, according to court records. 

Documents unsealed this week allege Patrick Steven Yaroch, who was a FBI Supervisory Special Agent working at the FBI Headquarters Counterintelligence and Espionage Division, claimed he “was frustrated that the FBI could not or would not act against adversarial cryptocurrency accounts.”

He then proceeded to “take matters into his own hands,” according to the affidavit filed with a district court in Virginia, and transfer $925,426.07 in crypto to his personal wallets over numerous transactions. 

Yaroch then allegedly toyed with the idea of retiring in Portugal with his wife, court documents claim, citing his ChatGPT history, but later confessed to a Department of Justice employee what he had done. 

“Yaroch told DOJ employee 1 that he made some very poor decisions related to cryptocurrency wallets,” court documents read. “Yaroch said that he went into FBI systems and found keys needed to transfer money from wallets to himself.”

A motion for a detention order, made public on Tuesday, added: “The weight of the evidence against the defendant is strong. He confessed to stealing the cryptocurrency from the adverse nations’ wallets.” 

Court filings further allege that Yaroch “previously had access to some of the nation’s most secret and important information. He then chose to misuse this information to steal money, for his own financial gain.”

It adds that the defendant has been charged with two felonies that carry a maximum penalty of 10 years of incarceration each. 

The nation in question has not been named in the documents. 

The court documents made public this week only briefly mention that Yaroch had a tiny amount of Bitcoin in his Kraken account; the vast majority of his funds were held in stablecoins. 

Yaroch, from Ashburn, Virginia was fired from the FBI on July 31, and investigations are ongoing, according to the court documents. 

This post FBI Agent Accused of $1 Million Crypto Theft From ‘Adversarial Nation’  first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.