An attacker who exploited the Liquid Network on September 6, 2026 returned 3,400 BTC the following day but retained around 598 BTC, demanding a 10% bug bounty that Blockstream refused