TLDR: A Bitcoin network run by one of crypto’s most respected figures, Adam Back, was hacked on September 6 and $320 million of user funds remains frozen. Blockstream’s Liquid Network users still cannot get their money out (contrary to highly misleading statements being put out by Adam Back and Samson Mow). We believe this is the end stage of a multi-billion dollar fraud we have been investigating.
We were the first to report that Christopher Cook, who runs Blockstream's Bitcoin mining business, spent three years in prison for fraud. We also reported that he was raising billions from investors under the Blockstream name without telling those investors about his conviction. Bloomberg has now confirmed key facts (and credited NatInfoSec in Bloomberg)!
Adam Back's Bitcoin mining business is, in our view, a Ponzi scheme, meaning the money coming in from new investors was used to pay the old ones, while new money was raised on the promise of unrealistically high returns. Blockstream has been selling this Bitcoin cloud mining investment since 2021, some of it on a promise of 20% returns a year. The Luxembourg platform that helped Blockstream raise all this money, STOKR, presented itself as an independent Luxembourg regulated venue. But STOKR is partly owned by Adam Back who was also taking Bitcoin loans from STOKR. Investors were not alerted to any of this!
In April, The New York Times named Adam Back the likeliest inventor of Bitcoin, a story we believe The New York Times was hoaxed into running. Two months after the press coverage Adam Back was in front of American investors asking for billions for a new company whose entire business would be buying and holding Bitcoin (we believe this Bitcoin did not exist in its entirety, and the custodian chosen to hold and verify it, Komainu, was not independent). The timing is rather fishy.
Bitcoin is hard, and Blockstream used that to their advantage. Journalists, investors, and in some cases Blockstream's own employees could not read the software or understand the operations, so the reputations of Adam Back and Blockstream were taken on faith rather than verified. Even Blockstream’s enemies helped. For a decade some of the loudest voices in crypto have cast Blockstream as a shadowy cabal quietly steering Bitcoin, a theory that credits Blockstream with enormous competence. Whether they admired Blockstream or feared it, people assumed Blockstream was highly competent, and in our opinion it was not.
Blockstream is now coming apart at the seams. On August 20, Cantor Fitzgerald killed Adam Back’s planned multi-billion dollar US stock listing. Adam Back’s side then agreed to pay Cantor $15 million to get out of a deal that, by the contract’s own terms, either party could have walked away from for nothing. On September 6th Blockstream’s Liquid Network was hacked and has been frozen ever since with users unable to get their money out. Quick summary:
Contrary to The New York Times, Adam Back is not the inventor of Bitcoin. In April 2026 the Times named Adam Back, the CEO of Blockstream, as the likely inventor of Bitcoin, a claim that would make Adam Back one of the world’s richest people, worth about $80 billion. We believe the Times was hoaxed, and that the feature was planted to boost Adam Back’s profile just before he asked investors for billions through a US stock market listing. According to our sources, Adam Back was borrowing Bitcoin from friends at 5% interest, hardly the behavior of a man sitting on one of the world’s largest fortunes.
Adam Back is in our view a front man, and a convicted fraudster runs Blockstream’s largest business. In our view real control of Blockstream sits with Samson Mow, Christopher Cook, and Oleg Mikhalsky of Fulgur Ventures, a Russian-founded venture capital fund. Christopher Cook, who runs Blockstream’s Bitcoin mining business, served three years in federal prison for fraud, and investors were never told this. Christopher Cook has since bought more than $442 million in personal assets, including multiple jets, yachts, and over 40 homes.
We believe Blockstream raised billions through a Ponzi scheme combined with a bust-out fraud. The company sold Bitcoin mining investments promising returns of up to 20% a year, and in our view new money paid earlier investors while insiders drained the business and ran up debts. STOKR, the “independent” platform that sold these investments, is partly owned by Adam Back and lent Adam Back 50 Bitcoin. Neither fact was disclosed to investors.
Riding the publicity from The New York Times feature, Adam Back tried to raise billions more on the US stock market. After investors in the deal learned of serious red flags through our June 2026 exposé, the shareholder vote was cancelled and Cantor Fitzgerald ended Adam Back’s stock market listing. Adam Back’s side agreed to pay Cantor Fitzgerald $15 million to leave a contract that either party could have exited for free.
Blockstream’s own dashboard shows its Bitcoin mines running at about 15 exahash per second, but by our calculations Blockstream would need 35 to 45 exahash just to produce the Bitcoin it has promised investors, meaning Blockstream Bitcoin mines cannot possibly mine enough Bitcoin to pay investors what they are owed as we laid out in Part 1 of our investigation.
Blockstream is now falling apart in public, while Samson Mow and Adam Back issue statements we believe are highly misleading. On September 6, 2026, a hacker drained nearly 4,000 Bitcoin from Blockstream’s Liquid Network, and all user funds (about $320 million in Bitcoin) are still frozen. Christopher Cook, meanwhile, faces a growing list of lawsuits over unpaid electricity bills, a defaulted private jet loan, and other debts.
Read Part 3 of our investigation below in full to learn what comes next (Part 1 and Part 2).
Adam Back has enjoyed a decade of fawning press coverage. He was cited in the Bitcoin whitepaper. He was one of the first people Satoshi Nakamoto (the inventor of Bitcoin) emailed. Recently, The New York Times went further and named Adam Back the likeliest inventor of Bitcoin (we believe NYT was hoaxed, a lot more on this below).
Adam Back’s good PR run is over.
Bloomberg News has published an investigation into Adam Back and his Bitcoin mining company, a business that has raised billions of dollars from investors (some of it raised on the promise of 20% APR interest paid quarterly). The reporting details the financial distress engulfing Blockstream Mining (rebranded as Exacore) and describes how Christopher William Cook, a convicted financial fraudster who spent 3 years in prison, quietly pulled the strings managing billions raised by Blockstream.
Now that the story is breaking wider, we want to restate what our investigation has led us to conclude.
Blockstream is a House of Cards
There is a narrower story Blockstream would prefer the public focus on, one involving a Bitcoin mining subsidiary that was spun out, Blockstream Mining Note investors facing some repayment problems, and an executive whose fraud conviction was regrettably not disclosed to investors (oopsie!).
We do not believe that’s the real story. The problems run across an entire range of Bitcoin companies connected to Adam Back, Samson Mow, and Fulgur Ventures, a Russian venture capital fund closely tied to Adam Back, operations that a highly placed insider has described as “a bunch of boxes that all move money around run by people in a small circle of trust”.
Based on the documents and records we have published, Blockstream and its related ventures appear to be a Ponzi scheme (a type of investment fraud that pays old investors with new investor money while borrowing more by promising high rates of return) rather than an operating business creating value. That includes Samson Mow’s Jan3, which was largely built on products developed inside Blockstream and transferred to him when he “left” the company.
The prodigious money borrowing machine was built on demonstrable falsehoods, and the money raised from investors went to lavishly paying executives while Blockstream racked up year after year of losses. Christopher Cook, the convicted fraudster who spent 3 years in prison before working as Blockstream’s Chief Information Officer bought multiple planes, more than 40 houses, and multiple yachts. Samson Mow and Adam Back were also richly rewarded, often flying on private jets and having hired security and other accouterments typically enjoyed by executives who run successful business ventures (not a failing, flailing crypto science project that functions as a Ponzi scheme, in our opinion).
Do you know something we don’t? We’re looking to hear from current and former employees of Blockstream, Exacore, and STOKR, and from anyone who has worked with, invested alongside, or lent money to Adam Back, Samson Mow, or Christopher “Chris” Cook. We can share what we’ve found that isn’t in this piece, and we protect our sources. Visit our website NatInfoSec.com and email us at nat@natinfosec.com.
Now that the lies and obfuscation are in the open, we hope the focus of investigations will turn to the other architects of the Blockstream Mining Note (BMN), among them Samson Mow.
BSTR, A Ponzi Scheme Listing On The American Stock Market?
The publicity wave (including Adam Back’s all black wardrobe makeover and hired bodyguards) had something to sell. Two months after the Times piece, the SEC cleared the way for the Bitcoin Standard Treasury Company (BSTR), which Adam Back and his partners at the Russian venture capital firm Fulgur Ventures were taking public on the stock market through a merger with a Cantor-sponsored SPAC. We believe the listing was intended to solve the funding problem by opening the Blockstream fundraising structure to American investors.
According to highly placed sources, BSTR was conceived inside Fulgur Ventures as “a way to stabilize Blockstream and finally make the company stand on its own feet”. In this telling, the public stock listing with Adam Back as front man was not a bold new venture but a rescue mechanism, designed to recapitalize the wider Adam Back universe (which we believe to include Capital B in France, H100 Group in Sweden and other firms) with fresh money from American public market investors.
A successful listing would have brought in substantial new capital at a moment when, according to the records published, obligations to creditors were going unpaid. Proceeds from a public offering could have been used to satisfy those existing liabilities, a use of new investor money to retire old obligations that, in our view, would have expanded this Ponzi scheme fraud dramatically.
Adam Back’s aborted BSTR stock market listing also lacked a safeguard investors normally take for granted that is the Bitcoin custodian BSTR selected, Komainu, was controlled by Adam Back, and related parties rather than an independent third party. The captured-custodian arrangement made independent verification of Bitcoin being contributed impossible.
Had Adam Back’s stock listing proceeded, public market investors would have committed several billion dollars into this Adam Back and Fulgur Ventures sponsored stock listing.
Do you know something we don’t? We’re looking to hear from current and former employees of Blockstream, Exacore, and STOKR, and from anyone who has worked with, invested alongside, or lent money to Adam Back, Samson Mow, or Christopher “Chris” Cook. We can share what we’ve found that isn’t in this piece, and we protect our sources. Visit our website NatInfoSec.com and email us at nat@natinfosec.com.
What investors were told about Adam Back’s BSTR fund-raise and what actually happened privately diverge sharply. In July 2025, Sean Bill (Blockstream’s former Chief Investment Officer and BSTR’s current CIO) sent marketing emails from a blockstream.com address, copying Adam Back, telling prospective investors that more than 80% of the targeted 30,000 Bitcoin commitment for Adam Back’s BSTR stock market listing was “already secured” and that the team “invests substantial personal capital alongside partners.”
A person Adam Back personally solicited for loans tells a different story. When Adam Back’s BSTR called the capital in March 2026, the subscribers who had committed reportedly refused to fund the deal. Adam Back told that person he could have sued his own anchor investors, but not on the eve of a listing as it would look bad. Instead, Adam Back scrambled to cover the shortfall by borrowing Bitcoin from friends at 5% interest for a few months. Adam Back stated to another prospective lender he approached that he (Adam Back) could not use his own money because it was tied up in leveraged trading positions he did not want to close at a loss.
Both claims in Sean Bill’s email were false, because the “secured” commitments fell through when Adam Back’s BSTR called the capital and the “substantial personal capital” turned out to be Bitcoin that Adam Back at least partly borrowed from friends. And per a source with knowledge of the arrangements, the private money raised outside the SPAC was raised by Samson Mow, Christopher Cook (the convicted felon), Sean Bill, and Adam Back.
The timing of this borrowing binge by Adam Back and Blockstream is interesting, because it coincides with an unusual drawdown of funds from Blockstream Mining. On March 20, 2026, Blockstream’s own Blockstream Mining Note (BMN) dashboard recorded a “Redemption” of more than 9,200 BMN notes for a disclosed redemption amount of $443,173,340.
It is by far the largest outflow in the investment’s history, at a business whose investors and vendors were going unpaid, in the very month Adam Back was soliciting personal Bitcoin loans from friends at 5%. Blockstream should say who got this money, what they were actually paid, and on whose authority. We invite Blockstream to explain how notes marketed as redeemable only at maturity years away in 2028 produced a $443 million redemption for someone in March 2026, while everyone else is waiting.
On August 20, 2026, Cantor Equity Partners I filed an 8-K terminating Adam Back’s BSTR stock listing in its entirety. The attempt to save Blockstream with a Bitcoin treasury has failed completely.
Now that Adam Back’s stock market deal, BSTR, is dead, according to multiple sources the cash and Bitcoin that investors contributed have not been returned. Instead investors have been offered a new story. The termination press release says BSTR will carry on as an unlisted treasury company, still “pursuing active Bitcoin treasury management.” That cannot work, because the treasury-company model is an arbitrage on public markets. A listed company raises capital cheaply at a premium to the value of the Bitcoin it holds, then spends the proceeds buying more Bitcoin. Remove the stock market listing and the premium goes too, and with it the cheap capital and any route out for the people who put money in to exit easily. That leaves an illiquid pool of other people’s Bitcoin, held by people who in our view should not be trusted with it.
Do you know something we don’t? We’re looking to hear from current and former employees of Blockstream, Exacore, and STOKR, and from anyone who has worked with, invested alongside, or lent money to Adam Back, Samson Mow, or Christopher “Chris” Cook. We can share what we’ve found that isn’t in this piece, and we protect our sources. Visit our website NatInfoSec.com and email us at nat@natinfosec.com.
The New York Times Satoshi Hoax Weaponized To Defraud Investors?
On April 8, 2026, two months before the SEC cleared the way for Adam Back’s Bitcoin Standard Treasury Company (BSTR) stock market listing, The New York Times published a featured investigation proclaiming Adam Back the likeliest inventor of Bitcoin. The piece got the full-court press treatment from The New York Times, with podcasts, video segments, and syndicated coverage around the world. The effect of the piece was a two-month publicity wave that reached a crescendo and burnished the credibility of a notorious self-promoter who was about to ask American investors for their money for a deal that would’ve been terrible for the investors.
According to sources familiar with the reporting, the publication deadline of the Adam Back Satoshi feature in the Times was moved up after the journalist was falsely led to believe a competing piece was about to name Adam Back as Bitcoin’s inventor first. To us, the Times looks like a foolish mark. The journalist’s big ego, poor understanding of technology and scoop instincts were weaponized to deliver a ridiculous advertisement right at the time Adam Back, his partners like Samson Mow and Christopher Cook, and Adam Back’s Russian funders at Fulgur Ventures required the publicity to raise money for a terrible deal for investors (i.e. BSTR). According to sources familiar with how the Adam Back Times piece was assembled, the journalist leans on Google's Gemini to have complex technical material explained to him (key fact being Google’s Gemini is one of the worst LLMs).
None of this is out of character. The same Times reporter caught a lucky break years ago on a famous fraud investigation while at the Wall Street Journal, a break that went viral owing to the fraudster being a captivating figure, which the journalist finagled into a personal brand, and along the way developed a private reputation for an oversized ego, extreme rudeness, manipulative tendencies, deceptiveness and hubris. Sources have described the journalist's troubling behavior as including being incredibly abusive toward an editor who was widely respected (and revered) in the newsroom. Sources also say the journalist has, in recent years, been steered in wrong directions by a handful of high-profile Silicon Valley figures who fed him narratives that suited their own agendas, a pattern that fits neatly with what appears to have happened on the Adam Back Times featured investigation.
The Times’ investigation was lacking in rigor and rested almost entirely on superficial stylometric analysis and a selected set of circumstantial coincidences, with little independent corroboration. The article's central claim, that Adam Back anticipated nearly every part of Bitcoin years in advance, credits one person with ideas that circulated widely on the Cypherpunks mailing list. Who planted the false rumor of a competing media piece about to name Adam Back as the inventor of Bitcoin, and who benefited from the timing, are questions worth a reporter’s time. We hope the Times asks them of itself. Furthermore, the author of the piece had a significant conflict of interest, with a reported $3 million book deal tied to the hypothesis of Adam Back being the inventor of Bitcoin.
Also of interest is how the Times journalist used a family member working at a competing news organization to successfully spy on that competing newsroom's progress on a high-profile story.
There is even more the Times should have easily caught but missed. According to multiple highly placed sources, in February and March of 2026 Adam Back was under significant liquidity stress and was personally seeking Bitcoin loans from friends and business partners, offering 5% interest on bridge loans of three to four months. That the Times could spend 18 months investigating Adam Back without detecting this liquidity stress (which puts an end to the secret fortune Adam Back was sitting on if Adam Back was the real inventor of Bitcoin), and without discovering the convicted fraudster at the center of Adam Back’s Bitcoin mining business that was raising billions from investors using Adam Back’s name, is a stunning failure of the journalistic process.
Our role in exposing and disrupting criminal activity is typically that of a researcher, supporting the work of actual journalists (our established prior work includes exposing Pakistan based fentanyl traffickers and Russian drone makers in conjunction with highly respected journalists). Between the Times’ irresponsible advertisement of what we believe to be a fraud and the SEC’s greenlighting of Adam Back’s BSTR, which we believed to be a larger fraud still, we had to move. In early June we published an investigation laying out the numerous governance failures at Adam Back’s proposed stock market listing BSTR and the undisclosed liabilities at Blockstream and revealed for the first time Christopher Cook’s fraud conviction and larger role in the Adam Back universe of companies.
Do you know something we don’t? We’re looking to hear from current and former employees of Blockstream, Exacore, and STOKR, and from anyone who has worked with, invested alongside, or lent money to Adam Back, Samson Mow, or Christopher “Chris” Cook. We can share what we’ve found that isn’t in this piece, and we protect our sources. Visit our website NatInfoSec.com and email us at nat@natinfosec.com.
We do not believe Adam Back is Satoshi Nakamoto. Adam Back has never signed a public message with Satoshi’s private key, the one piece of proof that would actually settle the question. The New York Times published a coincidence-rich profile of Adam Back, a self-promoting programmer, and delivered it with hubristic certainty. Two months later, Adam Back asked American investors for several billion dollars on behalf of himself and the unusual cast of characters behind him.
We believe the Times was hoaxed. A newsroom short on technical understanding and long on confidence was, we think, steered by interested parties toward the story that was commercially valuable.
And consider how implausible the whole thing is. Whoever really created Bitcoin is believed to still control some of the earliest Bitcoin ever mined, known as the Patoshi coins, worth about $80 billion today, plus a few billion more in Patoshi-adjacent early mined coins (which are not Patoshi coins and can therefore be moved with reasonable anonymity and without tanking the price of Bitcoin). Someone sitting on a fortune that size does not go around and borrow money at such a frantic pace as Adam Back. Adam Back has raised money from ordinary investors by promising them 20% a year through STOKR, and has reportedly scrambled to borrow Bitcoin from friends, at 5% interest for a few months, as Adam Back’s cash was apparently tied up in leveraged trades that were underwater. And when the Liquid Network was hacked on September 6, Adam Back reportedly could not cover the 600 Bitcoin needed to backstop the Blockstream federation's reserves himself. The real Satoshi, sitting on $80 billion plus, would have no reason to behave like this.
Adam Back: The Fake CEO
Adam Back has carried the title of CEO of Blockstream. In our assessment, based on the documents and records we have published, the title was largely ceremonial. The actual levers of the business, by the accounts we have reviewed, were held by three other men.
The first was Samson Mow. Samson Mow joined Blockstream as Chief Strategy Officer in 2017, and according to multiple highly placed sources, during his tenure it was Samson Mow, not Adam Back, who was regarded inside the company as the real CEO. It was on Samson Mow’s watch, and we believe with his central involvement, that the Blockstream Mining Note was created and used to raise substantial sums from investors. Samson Mow promoted the Blockstream Mining Note (BMN) publicly and even recently answered BMN critics (such as Matthew Kratter) on social media loudly denying Blockstream was running a Ponzi scheme, and while still at Blockstream Samson Mow issued his own similar token, EXO, sold to retail investors on the same STOKR platform (buyers of which seem highly chagrined by how it performed after losing their money). Samson Mow’s 2022 departure to launch Jan3 was, in our view, more of a superficial disengagement, with Samson Mow’s Jan3 largely built on products developed inside Blockstream and handed to Samson Mow on his way “out”. With Samson Mow still playing a large role in managing developer cadence at Blockstream, Samson Mow’s exit from Blockstream seems to be in appearance only.
Samson Mow is, in our view, a shameless and cynical self-promoter, not the highly successful libertarian entrepreneur and polymath (with mainland China sympathies) Samson Mow LARPs as online. Strip away Samson Mow’s frequent (senseless, in our view) $1 million Bitcoin price predictions and what remains is a two-decade résumé on which, as far as we can tell, Samson Mow has never built anything that made money for anyone (other than Samson Mow).
Samson Mow’s career seemingly started in video games at Relic Entertainment, where he worked from 2005 to 2007. Although other people led actual design and direction of the video games. Samson Mow then seemingly spent about a year and a half working at Sitemasher, a Vancouver startup, and left in 2009, before it was acquired. At Ubisoft Chengdu, Samson Mow’s most frequently cited credit is executive producer of a Facebook game that he claims reached more than 10 million users.
A video game company Samson Mow actually founded himself, Pixelmatic, has existed for a long time and is infamously known for Infinite Fleet, a video game that has spent the better part of a decade in development. Infinite Fleet was funded with EXO tokens (the investment token for Exordium Limited, the company that publishes Samson Mow’s video game Infinite Fleet), which Samson Mow sold to retail investors on STOKR (yes, the same STOKR) while he was still Chief Strategy Officer of Blockstream, using Blockstream’s Liquid Network. EXO token buyers, as we have noted in this investigation, are not pleased, and several have publicly accused Samson Mow of defrauding them. What Samson Mow’s investors receive in return seems to be a steady stream of cartoon renders seemingly from the game posted by Samson Mow to X.com (formerly Twitter), seemingly to convince people the project is still alive.
Samson Mow appears to have entered cryptocurrency in 2015 as Chief Operating Officer of BTCC, an exchange he neither founded nor built. There, by his own bios, he directly managed BTCC's Bitcoin mining (an interesting detail to keep in mind). Samson Mow joined Blockstream in 2017, and it was on his watch, and with him credited as one of its creators, that the Blockstream Mining Note investment was sold to investors. As we laid out in Part 1, Blockstream's mines show about 15 exahash per second as per the dashboard, while the Bitcoin promised to noteholders would take 35 to 45 exahash to produce. Plenty of investors could not have checked that math. Samson Mow, a former Bitcoin mining pool operator, is one of the few people at Blockstream who could not plausibly claim ignorance of it, and he has publicly stated as of a few weeks ago that the Blockstream Mining Notes are not a Ponzi scheme.
HBO’s 2024 documentary Money Electric is a hunt for Satoshi Nakamoto (the inventor of Bitcoin), and Samson Mow, credited on screen as a “Bitcoin Ambassador,’” spends it pointing the hunt at Adam Back in a highly misleading and deceptive way, in our view. Samson Mow tells the director that Adam Back’s birthday is April 5th, Satoshi’s supposed birthday, and when Adam Back objects that it isn’t, Samson Mow calls it an “inside joke.” Asked directly who Satoshi is, Samson Mow says “you can make a strong case” for Adam Back, then hinting that he himself along with Adam Back was Satoshi Samson Mow says “Satoshi was a team... just kidding.”
Then there’s Samson Mow’s other famous failure and misleading statements about it, El Salvador’s Volcano Bond, a $1 billion Bitcoin-backed bond Samson Mow announced on stage with President Nayib Bukele in November 2021, promising El Salvador would become “the financial center of the world” and named its “architect.” The Volcano Bond never launched. Samson Mow claimed $300 million in commitments within a month; launch dates came and went; El Salvador quietly abandoned the project. Not one dollar was ever actually raised, though the volume of Samson Mow’s promotion left many believing the Volcano Bond financial product actually existed.
Samson Mow’s next great failure has cost users dearly, Aqua Wallet, which parks users’ Bitcoin as Liquid Bitcoin (L-BTC) on Blockstream’s Liquid Network (without making it obvious to users that they were not holding real Bitcoin, but an IOU from Blockstream), frozen since September 6 Liquid Network hack. According to sources, when El Salvador moved under IMF pressure to divest its state-run Chivo wallet, Samson Mow pushed hard for his Aqua Wallet to replace it. El Salvador did not, which didn’t stop Samson Mow from proclaiming that the actual statements from the El Salvador government were not true and that things were continuing as planned.
A recent addition to the long string of, in our view, Samson Mow’s dubious failed ventures is ProductionReady, Inc., a 501(c)(3) non-profit Samson Mow launched in Austin in 2025 with Jimmy Song and others. Samson Mow intended ProductionReady as a way to shape how Bitcoin's software develops, which would have given Samson Mow sway over Bitcoin itself. The launch of ProductionReady came amid a steady stream of social media posts and podcast appearances in which Samson Mow attempted to capitalize on the widespread discontent with Bitcoin Core at the time. Had the plan worked, that influence would likely have translated into economic power for Samson Mow. It did not work. Samson Mow aggressively sought funding for the project from two large investors who have funded Blockstream, according to two human sources familiar with the discussions. Financial records reviewed by us show neither firm funded Samson Mow’s ProductionReady despite the substantial pressure applied by Samson Mow.
After Blockstream’s Liquid Network was hacked on September 6, Adam Back went silent for several days, while Samson Mow posted regular updates on X.com (formerly Twitter) and gave every impression that he (Samson Mow), personally, was handling the negotiations with the hacker.
The second individual who held real CEO power at Blockstream was Christopher "Chris" William Cook, a convicted financial fraudster who spent 3 years in prison and was brought into Blockstream by Greg Maxwell. Christopher Cook also has a penchant for living large, having bought multiple private jets, yachts, and more than 40 homes, funded, we believe, substantially with investor money as documented elsewhere in this investigation.
Christopher Cook quietly directed affairs not only at Blockstream Mining but, according to sources, across the wider Adam Back universe of companies. According to sources, when meeting people Christopher Cook told a rehearsed version of his background that went like this… Christopher Cook won the international science fair three years in a row, which led to him (Christopher Cook) working for NASA (false). Christopher Cook would also describe himself as the CIO of a fintech company who also produces music. The distinctive kicker was Christopher Cook's claim that he uses the satellite dishes at Etam, West Virginia to bounce signals into outer space and make music from them, tied to his "Odyssey" DJ/brand persona and an ambition to perform as a DJ in a space suit.
Christopher Cook's other ambitions appear more down to earth relatively speaking. According to CNBC, Christopher Cook, was among the Bitcoin executives who sat down with Donald Trump at a closed-door roundtable on the sidelines of the Bitcoin 2024 conference in Nashville in July 2024. According to sources, Nashville was not the only time Christopher Cook has met Donald Trump. Ten months later, Christopher Cook and Adam Back put money into Donald Trump's company. Trump Media & Technology Group's SEC filing for its May 2025 Bitcoin treasury raise lists Christopher Cook's C Systems USA LLC buying 486,003 shares at $25.72 each, ~$12.5 million, alongside ~$17.5 million from Adam Back. We hope journalists reading this pull on this thread closely.
The third person who functioned as de facto CEO of Blockstream is Oleg Mikhalsky, a manager at Fulgur Ventures. Fulgur Ventures is a Russian venture capital fund run out of Viareggio, Italy. It is the investment vehicle of Vitaly Bezrodnykh, a Russian investor who apparently holds substantial wealth in Bitcoin, much of it believed to have been acquired while he was a US taxpayer based in California. Although Fulgur Ventures reportedly manages money for a small number of other Russian investors as well, day-to-day control is concentrated in the hands of a single manager, Oleg Mikhalsky, who by several accounts is highly incompetent.
By late 2023, according to people familiar with the matter, Blockstream was close to collapse. The money that kept Blockstream alive came from Fulgur Ventures, where day-to-day control of Blockstream sat with Oleg Mikhalsky and not Adam Back. Oleg Mikhalsky is said to be personally extremely close to Christopher Cook, the convicted felon who ran Blockstream Mining; the two have reportedly vacationed together, and Oleg Mikhalsky has flown on Christopher Cook’s private jet.
The motive for the Fulgur Ventures rescue of Blockstream was reportedly driven by narrative concerns for Bitcoin itself rather than commercial logic, since Blockstream was seen as too big to fail for Bitcoin's reputation. Vitaly Bezrodnykh however stated he "did not want to do charity", so the rescue of Blockstream by Fulgur Ventures had to pay for itself. The solution was the treasury company playbook, worked out in a series of meetings held in Viareggio, Italy, where Fulgur Ventures is run from, and in Lugano, Switzerland. A new public company (BSTR) would use Adam Back's name to attract cheap capital with a US stock listing with Blockstream providing services, spend that capital buying Bitcoin, and let the proceeds sustain Blockstream's loss-making and poorly run operations. As an unknown Russian investor, Vitaly Bezrodnykh stated he could not credibly front such a Bitcoin treasury company himself, whereas Blockstream had the brand and Adam Back could serve as the front man for these capital market ambitions.
Around this time, Vitaly Bezrodnykh reportedly regarded Blockstream Mining as a financial “cancer.” Vitaly Bezrodnykh wanted Blockstream Mining separated from the rest of Blockstream and expressed astonishment that a business could lose so much money. If that account is accurate, Vitaly Bezrodnykh may not have known how close his trusted manager, Oleg Mikhalsky, was to Christopher Cook, who was running up Blockstream Mining’s debts. After the Fulgur Ventures rescue, Blockstream effectively became a front company for Fulgur Ventures (the Russian venture capital firm).
Giancarlo Devasini and Paolo Ardoino of Tether are also said to have taken part in the discussions held in Viareggio and Lugano while Adam Back pleaded for a way to save Blockstream. Paolo Ardoino was reportedly adamant that Tether would not put up the money to save Blockstream (having been frustrated with Blockstream’s reportedly abysmal handling of Liquid Network which he had high hopes for). Paolo Ardoino’s argument, in substance, was that funding Blockstream would be throwing good money after bad, because Blockstream was doomed.
According to human sources, Vitaly Bezrodnykh is currently confident that he is not liable to make Blockstream Mining Note investors whole or liable to pay debts incurred by Adam Back or Blockstream, even though Fulgur Ventures has used Blockstream to make investments and divestments, that is, to move funds through Blockstream.
Do you know something we don’t? We’re looking to hear from current and former employees of Blockstream, Exacore, and STOKR, and from anyone who has worked with, invested alongside, or lent money to Adam Back, Samson Mow, or Christopher “Chris” Cook. We can share what we’ve found that isn’t in this piece, and we protect our sources. Visit our website NatInfoSec.com and email us at nat@natinfosec.com.
Oleg Olegovich Mikhalskii (also spelled Mikhalsky) was born in Moscow on April 3, 1976. Records reviewed identify his parents as Oleg Vladimirovich Mikhalskii and Anna Ivanovna Mikhalskaia. He started his career in 1998 at the Moscow International Business Association and, after a short stint at a Moscow arts center, joined Kaspersky Lab, where he worked from November 2001 to June 2008. Vitaly Bezrodnykh also worked at Kaspersky Lab from 2002 to 2011, and that is where the two men became close. Both later left Russia with their families after Vitaly Bezrodnykh allegedly fell out with Russia’s kleptocratic power structure.
That history helps explain how Fulgur Ventures became a fund run by a small circle of people Vitaly Bezrodnykh already knew and trusted, chosen, in our view, for loyalty rather than competence. It also explains how a career software manager (Oleg Mikhalsky) with no public-markets experience ended up with signing authority over the vehicles behind major US stock market investments.
According to sources, Oleg Mikhalsky was intensely focused on generating revenue at Blockstream, a company that, by its structure, had little capacity to produce any real revenue. This inability to generate revenue reportedly caused considerable frustration for Oleg Mikhalsky. Christopher Cook, by contrast, was said to be consistently receptive to Oleg Mikhalsky’s demands for “fast revenue” and ready with creative proposals for bringing in revenue quickly.
Adam Back’s role at Blockstream, we believe, was not to operate a business as a CEO. His job was to be the famous headliner around whom a myth was built. The front man heading fundraising rounds, shilling the Bitcoin cloud mining investments, and at the end a failed US stock listing. Behind the scenes, real control of Blockstream was divided. Samson Mow was effectively the one controlling Blockstream as its CEO (and recently defending Blockstream from allegations of running a Ponzi scheme while shilling BSTR hard). Christopher Cook ran the operations and, by several accounts, had an unusual sway over Adam Back. And when the money ran out, Russian VC fund Fulgur Ventures bought Blockstream whole, and Oleg Mikhalsky took control. Investors believed they were trusting Adam Back. What they were actually trusting, in our view, was a convicted fraudster they had never heard of, a strategy chief who appears to have pretended to leave the company but is still making crucial decisions, and a Russian manager who is serving two masters (i.e. Oleg Mikhalsky serving Christopher William Cook the felon and Vitaly Bezrodnykh).
Paraphrasing the famous rapper Jay-Z, Adam Back “is not a businessman”. Adam Back “is a business, man” but a business widely promoted and run by other people, and, we believe, monetized better by those people than Adam Back could manage himself.
Christopher Cook Takes Investor Funds Over Blockstream’s Liquid Network
According to records we reviewed, Blockstream’s mining entities received three USDT payments totaling $3 million in July 2024. The records confirm the money as coming from investors in Blockstream Mining Note 2 (BMN2). All the money was paid to Christopher Cook or his personal company rapidly (this is not normal!). Of the $3 million, $2.5 million went straight to Christopher Cook directly and was booked as “a USDT advance to employee.” The remaining $500,000 paid invoices from Waterway Wireless (for readers who read Part 1 of our investigation the company name should ring a bell), a Florida company whose president is Christopher Cook.
In plain English: Blockstream Mining Note investors invested $3 million to mine Bitcoin, and all $3 million of it was paid out to Christopher Cook.
For readers new to this investigation: Blockstream has raised more than $1 billion through just the Blockstream Mining Note, a tokenized Bitcoin mining investment, and has since doubled the program's cap to $2 billion. Blockstream promised investors fixed returns of 20% a year on some investments. By our calculations, Blockstream's Bitcoin mines could never have produced these returns.
On June 8, 2026, we revealed for the first time that Blockstream's Bitcoin mining business was run by Christopher Cook, who served three years in federal prison for fraud. Investors were never told about the conviction. Records show that Christopher Cook's family filed for bankruptcy as he was leaving prison. After Christopher Cook joined Blockstream as a salaried executive, he bought more than $442 million in personal assets over the years we examined, including multiple private jets, yachts, Lamborghinis and more than 40 homes. In May 2025, Christopher Cook's company, C Systems USA LLC, bought about $12.5 million of Trump Media & Technology Group stock.
Most Ponzi schemes collapse when investors ask for more money back than new investors put in. If BMN2 is a Ponzi scheme, as we believe it is, it is an unusually well-built one, because it delays that point of failure. Investor money is locked up for 48 months, and ordinary investors have no right to redeem before 2028. An operator with a lock-up like that doesn’t quickly need new money to meet withdrawals for years, because there are no withdrawals to meet in the near term. BMN2 also raised money while the price of Bitcoin was rising, and it used Adam Back, who is cited in the Bitcoin whitepaper, as its biggest draw.
BMN1 holders were heavily incentivized to reinvest in BMN2 rather than withdraw their Bitcoin, with an unusual 15% bonus for keeping their money invested. This will look familiar to anyone who knows payment-in-kind (PIK) structures, in which a borrower pays investors with more of the same investment instead of cash. Investors accept the delayed payout in exchange for higher returns, and the arrangement is typically used by borrowers in distress who are short on cash.
Investors are told they are buying Bitcoin mining output, produced on Bitcoin mining machines at Blockstream's mining sites. But the contracts contain a clause called "Substitute Performance BTC," which lets Blockstream simply pay old investors with money (or Bitcoin) from new investors.
Ordinary investors had no right to redeem before maturity, anyone who wanted out had to find a buyer. Users turned to a Telegram group called @Blockstream_Finance, which was run by Adam Back, Christopher Cook and Arnab Naskar, the founder of STOKR. The trades themselves were negotiated and then executed over SideSwap[.]io. The Telegram user @Bitco1nArk was a significant buyer of Blockstream Mining Notes.
Liquid Network transactions with investor funds going to Christopher Cook personally:
https[:]//liquid[.]network/tx/ee3aa3277ec2636139d1de8a628d2d9a02434dfb760cbdd7222a5b1a92417a35
https[:]//liquid[.]network/tx/8dcf4ddecf026d1a0a72aea445e1d01b715e2b70b77263b38420fcb01646d640
Adam Back’s $15 Million Settlement Fee For Fraud?
The termination filing from Adam Back's Bitcoin Standard Treasury Company (BSTR), related to its failed stock market listing and filed on August 20, 2026, is a fascinating read (read more). The Business Combination Agreement contained no termination fee of any kind (read more). Article 10 lists seven ways to end the deal, and none of them carries a payment. Section 10.2 provides that on termination the agreement becomes void with “no Liability on the part of any Party,” subject to a single exception for willful breach or fraud occurring before termination. The outside date of July 16, 2026 had passed more than a month before the termination was signed. In plain terms, either side could have walked away for free. Adam Back’s side is being asked to pay $15 million anyway. Why?
A payment demand with no contractual trigger is typically not a routine fee. It is likely a legal settlement, and the document is written like one, with releases, a waiver of unknown claims, a covenant not to sue, and a provision voiding the release if an installment is missed by seven days by Adam Back’s side, while that side’s release of Cantor survives regardless.
The filing shows Blockstream Capital Partners (BCP), a company we understand to be controlled by the Russian venture capital fund Fulgur Ventures, agreeing to pay Cantor $15 million in installments, $10 million in September and $5 million in December. Under the BCA’s no-recourse clause, Cantor could not have pursued BCP under the contract at all, and the entities Cantor could pursue held essentially nothing. It should be obvious to anyone paying attention that Cantor felt Adam Back was personally unable to pay even $15 million so much so that Cantor insisted Fulgur Ventures through BCP pay the fee.
In our view, an interesting reading is that the $15 million demand for payment by Cantor is to extinguish a fraud claim.
Do you know something we don’t? We’re looking to hear from current and former employees of Blockstream, Exacore, and STOKR, and from anyone who has worked with, invested alongside, or lent money to Adam Back, Samson Mow, or Christopher “Chris” Cook. We can share what we’ve found that isn’t in this piece, and we protect our sources. Visit our website NatInfoSec.com and email us at nat@natinfosec.com.
In plain English: The failed BSTR deal had a built-in expiration date, July 16. Once that passed, either side could walk away at zero cost. Yet a month later, when they signed the termination papers, Blockstream’s side was required to pay Cantor $15 million. Why pay eight figures to exit a deal you could exit for free?
Where Did Adam Back’s Trump Money Come From?
While Blockstream Mining Note investors, Liquid Network users and vendors wait for payment, where was the money going? SEC filings offer a clue. Adam Back and Christopher Cook were participants in two large 2025 crypto stock deals.
Trump Media & Technology Group raised ~$1.4 billion to fund a Bitcoin strategy; its SEC filing names Adam Back buying 680,404 shares and Christopher Cook’s C Systems USA LLC buying 486,003. The same two names appear again in David F. Bailey’s Nakamoto venture, which raised ~$540 million in equity funding. The December 5, 2025 registration statement lists Adam Back buying 8,928,572 shares and Christopher Cook’s C Systems USA LLC buying 4,464,285 shares. We believe the funds were invested by Christopher Cook and Adam Back on behalf of a third party.
One of the many reporters reading this should look hard at the timing. By February and March of 2026, according to more than one highly placed source, Adam Back was asking friends and business partners for Bitcoin loans of three to four months at 5%. So within about three months of the December 5 Nakamoto filing, the man who had just bought millions of shares in two stock deals was borrowing short-term against his personal relationships. Where did the money Adam Back and Christopher Cook put into Trump Media and Nakamoto come from, and whose money was it? Noteholders and Blockstream Mining employees still waiting to be paid are entitled to ask.
The David F. Bailey connection to Adam Back goes deeper. Capital B, the French Bitcoin treasury company Adam Back fronts, counts UTXO Management among its investors. UTXO Management is David Bailey’s investment vehicle. So Adam Back invested funds into David Bailey’s Nakamoto, and David Bailey’s UTXO invested funds into Adam Back’s Capital B.
According to sources, Christopher Cook’s entrée into Trump world was arranged by David F. Bailey, Tracy Hoyos-López and Amanda Fabiano. Amanda Fabiano and Christopher Cook had an antagonistic relationship dating back to her time at Galaxy Digital, stemming from large loans that Blockstream and Christopher Cook took from Galaxy Digital. Florida UCC-1 filings show that Christopher Cook took out large personal loans from Galaxy Digital secured against Bitcoin. Amanda Fabiano later joined Nakamoto Holdings, which is run by David F. Bailey. How a convicted financial fraudster came to be introduced into the orbit of even this president, and by whom, is a thread we hope others will pull on.
The Convicted Fraudster Pays Big To Meet Donald Trump: On July 27, 2024, a few hours before a keynote speech at the Bitcoin 2024 conference in Nashville, Donald Trump sat down with several cryptocurrency executives in a closed room meeting. Guests had to reportedly seal their phones in signal-blocking pouches. The organizers set out thirty-five gold chairs as a nod to Bitcoin’s status as digital gold, but more high-paying donors turned up than planned and extra chairs had to be brought in. According to CNBC, a seat at the table was advertised at $844,600, the maximum an individual could give to the Trump 47 Committee.
Christopher Cook, the felon who spent 3 years in prison for fraud, was among the people Donald Trump met. CNBC identified him as the head of Exacore (formerly Blockstream Mining) and quoted him, as “a (Bitcoin) miner at this table,” praising Donald Trump’s grasp of how much energy AI and Bitcoin will need. According to sources, Christopher Cook was worried about the background check process ahead of the meeting.
The meeting also had a policy purpose. The one-page agenda handed to each guest asked for an official industry working group to shape policy, and that afternoon Donald Trump promised on stage to create a “bitcoin and crypto presidential advisory council.” In plain English, a man with a federal fraud conviction was sitting in a group that expected to help write the rules for the cryptocurrency industry.
Ten months after meeting Donald Trump in Nashville, Christopher Cook and Adam Back put money into the sitting President's company as mentioned earlier. In May 2025, Trump Media & Technology Group sold 55,857,181 shares at $25.72 each, raising ~$1.44 billion for a Bitcoin treasury. Its SEC filing lists Christopher Cook's C Systems USA LLC buying 486,003 of those shares, ~$12.5 million, alongside 680,404 shares, ~$17.5 million, bought by Adam Back. We believe the funds invested into Trump Media & Technology Group by Christopher Cook and Adam Back were on behalf of a third party.
Do you know something we don’t? We’re looking to hear from current and former employees of Blockstream, Exacore, and STOKR, and from anyone who has worked with, invested alongside, or lent money to Adam Back, Samson Mow, or Christopher “Chris” Cook. We can share what we’ve found that isn’t in this piece, and we protect our sources. Visit our website NatInfoSec.com and email us at nat@natinfosec.com.
The Enablers?
A famous front man (Adam Back) and hidden operators are not enough to raise billions. A machine with a perpetual need for fresh capital needs licensed gatekeepers, regulated middlemen willing to sell investments without asking too many questions. The gatekeepers in this case took their fees and lent out their Luxembourg regulatory licenses to investment products we believe are nothing more than a Ponzi scheme, all while being quietly owned by the very people who own Blockstream, including Adam Back personally and the Russian venture capital fund, Fulgur Ventures, that bankrolls Blockstream. This is a big deal. The Luxembourg-regulated "platform" selling billions of dollars of Blockstream investment products to investors is co-owned by Blockstream's own CEO and by Blockstream's largest shareholder (Fulgur Ventures), and none of it was disclosed to the people buying the investments (this is not normal!).
Enter STOKR, run by Arnab Naskar and Tobias Seidl. That Adam Back is a shareholder in STOKR is disclosed nowhere to the investors STOKR sells Blockstream investments to. STOKR was the venue for both the Blockstream Mining Note and Samson Mow’s EXO token, and markets itself as a Luxembourg-regulated investment platform. We have found no record of the diligence STOKR performed on Blockstream Mining, and no sign that anyone at STOKR, including its Head of Compliance, Milena Nikolova, ran the checks that would have surfaced Christopher Cook’s fraud conviction or visited Blockstream's Bitcoin mines to verify the hashrate, or noticed that Christopher Cook's NASA origin story was false. Either STOKR ran those checks and kept investor cash flowing to Blockstream anyway, or it never ran them. In the second case, what exactly was the compliance function for? On the evidence, STOKR was a cheerleader and enabler of what to us looks like an obvious fraud with a Luxembourg license.
STOKR was not a neutral venue in other respects either. Arnab Naskar appeared in Blockstream’s own press releases hyping Blockstream Mining Note BMN, touting its payout as the largest in the history of real-world assets. It is telling that Arnab Naskar recently stepped down from the role of CEO of STOKR, based on changes to the STOKR[.]io website Team page.
Then there are the curious loans to Adam Back. On May 12, 2025 and again on August 14, 2025, STOKR lent Adam Back 25 BTC at a time, at 4.8%, repaid in November 2025. Fifty Bitcoin lent, from the “independent” issuing platform to one of its shareholders and the CEO of its largest client. STOKR’s audited 2025 accounts stated that there were “no significant transactions for related parties.” That is a lie in a signed audit. Loaning fifty Bitcoin to a shareholder who is using your platform to issue billions in strange Bitcoin investment products, and then telling the auditor no related-party transactions exist, is pretty damning. Even by the lax standards of crypto this is beyond the pale.
STOKR's accounts show a company that lost money for years and then became highly profitable in a single year. STOKR reported a loss in every financial period from its incorporation in August 2018 through 2024, then a profit of EUR 9.08 million (about $10 million) for 2025. STOKR had an average of 5.33 full-time equivalent employees that year (STOKR S.A. annual accounts for 2025, Note 16, corrected filing of 2 June 2026, Luxembourg Business Registers, RCS B226662). By then Blockstream Mining Note (BMN) had raised about $1.08 billion, and the program's cap has since been raised to $2 billion. A 1% subscription fee on that $1.08 billion comes to about $10 million. That fee alone roughly equals STOKR's 2025 profit, so nearly all of the "independent," Luxembourg-regulated platform's profitability appears to come from its skim on the single Blockstream investment product it was supposed to be vetting.
Then there is Bitfinex Securities, which listed the Blockstream Mining Note (BMN) through its El Salvador-based trading venue. The head of operations at Bitfinex Securities is Jesse Knutson. Before that job, Jesse Knutson was Vice President of Financial Products at Blockstream, where he was responsible for the very business that churned out the mining note investment product. The man who helped build the product at the issuer moved to the exchange that listed it, then spent years on conference stages and in interviews promoting it as a triumph of tokenization!
Who at Bitfinex Securities was in a position to ask hard questions about an issuer whose product their own operations chief (Jesse Knutson) had helped build?
From Blockstream itself, a layer of long-tenured executives, among them former VP Warren Togami, gave the company the technical credibility that made the fundraising possible and defended L-BTC, a permissioned version of Bitcoin that is essentially an IOU on a federation Blockstream controls, as being sound when questions arose about the fraud.
Warren Togami’s highly deceptive defense of Blockstream’s Liquid Network aged poorly. On September 6, 2026, a bug in Blockstream's software let an attacker mint counterfeit L-BTC and cash it out for nearly 4,000 real Bitcoin belonging to users, leaving Blockstream’s reserves at roughly 85% of what is needed to back L-BTC and forcing Blockstream to halt the network. Warren Togami chose to take a public role in this debate. He has promoted and defended the Liquid Network to a large social media following and the defense we are responding to was made publicly and by choice.
Then there is Greg Maxwell (aka Gregory Maxwell, GMax), Blockstream's co-founder, Blockstream’s first Chief Technology Officer, and a controversial Bitcoin developer. Greg Maxwell served as Christopher Cook's entry point into Blockstream. The two have been friends since their teens, according to multiple sources, and the detailed technical indicators confirming the Greg Maxwell and Christopher Cook relationship were outlined in Part 2 of our investigation. Greg Maxwell is a public figure in the cryptocurrency space. For more than a decade he has posted prolifically on Reddit, Bitcointalk and other public forums, promoting his technical work and taking public positions in Bitcoin's most contested debates, including those involving Blockstream.
According to multiple sources familiar with Greg Maxwell and with Blockstream's engineering culture, Greg Maxwell is deeply insecure about his lack of educational credentials, and has long compensated for it by pushing for engineering solutions of high theoretical elegance and complexity, the kind that superficially signal intellectual firepower to other developers. Sources describe this pattern as pervasive across the code Greg Maxwell shaped at Blockstream, and as having bled into Bitcoin Core itself during the years he was a contributor. Confidential Transactions, range proofs, range-proof caching optimization at the heart of the Liquid Network hack, the Liquid federation architecture generally, and a long list of Bitcoin Core changes driven by Blockstream employees over the years, all sit somewhere on the Rube Goldberg end of the design spectrum when a plainer design would have done the job with fewer places for something to go disastrously wrong. For example, one of the most serious flaws ever discovered in Bitcoin (CVE-2018-17144) sat hidden for years and could have let someone create Bitcoin out of thin air, breaking the whole promise that only 21 million Bitcoin can ever exist. The flaw was introduced into Bitcoin by a co-founder and employee of Blockstream working on Bitcoin, Matt Corallo (known online as TheBlueMatt), and it was signed off by Greg Maxwell to be added into Bitcoin.
Blockstream's engineering reputation has long been treated as unimpeachable, largely because Bitcoin and cryptography are poorly understood by most of the people who write about the company and lap up its myth-building (helped along by number go up i.e. the price of Bitcoin going up being a form of validation). At its core, however, sources in the know describe Blockstream as a highly unserious organization run by incompetent, ego-driven people, and the September 6 Liquid Network hack is, in the words of one highly placed source, "the chickens coming home to roost for Greg Maxwell and his way of operating." Sources suggest code-bases touched by Blockstream need to be "de-Blockstreamed" in favor of simpler designs that do the job and are written with humility, not built to flatter their author's ego or justify big development budgets sought from rich patrons.
The September hack was also not the first serious vulnerability in Blockstream’s Liquid Network. On June 26, 2020 an outside developer, James Prestwich, publicly disclosed a security problem on the Liquid Network. Blockstream claimed it already knew about the vulnerability. In the post it published afterwards, the company acknowledged that it had deprioritized deploying a patch earlier that year in favor of other work, and that it had withheld public disclosure until the issue was resolved. Disclosure came when it did because a third party published first.
The defect sat between the functionary servers and the hardware security modules behind them. The two disagreed on timelock parameters, so some timelocks were refreshing after expiry rather than before. Once a timelock lapses, the Bitcoin behind it can be recovered using a set of emergency backup keys held by Blockstream (this is a big deal).
There are other defenders, such as Chris Seedor (@coinjoined), who loudly defended Adam Back and Blockstream in an obsequious manner when the fraudulent Blockstream Mining Note questions arose.
Seedor[.]io makes, in our view, cumbersome stainless steel Seedor Safe devices to back up crypto seed phrases which Chris Seedor (@coinjoined) markets on social media along with posting racist conspiracy theories.
Brian HoonJong Paik and Jonathan Zhan-Hua Leong are other Adam Back-related venture promoters, in our opinion.
Marc Baden Powell, of New Jersey, serves as legal counsel to Blockstream Mining and works closely with Christopher Cook. He was listed on a Blockstream Mining Note fundraising page and promotes himself in the family office sector. One person familiar with the relationship told us Baden Powell warned Christopher Cook that spending investor money on personal expenses could send him to prison.
Alexander "Alec" Thomas Chen and Joanna Flores Chen are a couple who, we believe, have long assisted Christopher Cook. We understand that Alexander Chen works at Blockstream and that Joanna Flores Chen works directly for Christopher Cook. We believe, Alexander "Alec" Thomas Chen routinely threatens employees with dismissal when they refuse to follow his diktats, and has pressured employees into naming companies controlled by himself and Christopher Cook as credit references to increase credit limits. A credit reference is meant to be an independent party vouching for a borrower. This is highly unusual. We believe their roles warrant scrutiny of whether they benefited from the flow of investor funds we have documented in our investigation.
According to sources, the relationship between Christopher Cook and the Chens has more recently soured, in part, we are told, over Christopher Cook reclaiming ownership of a home he had previously gifted to them (done so Christopher Cook could borrow against the home). There was extra friction with Alexander "Alec" Thomas Chen owing to Christopher Cook repeatedly making jokes about Joanna Flores Chen's unusually close long running relationship with Duver Felipe Medina who worked as Christopher Cook's private chef.
The Veski family: Phillip Veski, Sherri Veski, Brandon Veski, and Kimberly “Kim” Veski are, we understand, relatives of Christopher Cook who were placed on the payroll of his businesses including Exacore. Family members employed by the companies of an executive we believe was misappropriating investor funds warrant the same scrutiny as anyone else in Christopher Cook’s inner circle. We believe their compensation and any assets received should be examined against the flow of investor money we have documented in our investigations.
Andreas “Frey” Beiderwieden (@FreyMusic), German music producer very close to Christopher Cook, who acts as a gofer and occasional music collaborator to Christopher Cook. Andreas “Frey” Beiderwieden has reportedly joked that his relationship with Christopher Cook is akin to modern slavery. Christopher Cook reportedly jokes that Andreas “Frey” Beiderwieden is his “German exchange student.”
Stephen Rogers, known in Christopher Cook’s circle as “Uncle Steve,” is, we understand, a relative of Christopher Cook on his mother’s side. The Rogers family appears in the court record of Christopher Cook’s 2006 federal mail fraud case such as when Christopher Cook was released on a $250,000 personal surety bond, it was co-signed by his parents and by David B. Rogers and Margaret D. Rogers, his grandparents. According to sources, Stephen Rogers has for years drawn a salary from companies controlled by Christopher Cook, including, we understand, at Blockstream Mining. People familiar with the relationship describe him as a tempering influence on his nephew and say he holds no illusions about Christopher Cook. Stephen Rogers has privately reportedly described Christopher Cook as someone with “no empathy but a lot of money”. We believe the businesses that paid Stephen Rogers were funded, as we have documented elsewhere in our investigation, substantially with investor money, and his compensation warrants the same scrutiny as the rest of Christopher Cook’s inner circle.
Marcos Fernandez Cambiaso works for Christopher Cook, reportedly as an estate manager and specialty recruiter, and before that Marcos Fernandez Cambiaso is said to have worked for Sean Combs (aka P. Diddy). In March 2023, two men injured in a crash sued Marcos Fernandez Cambiaso, Christopher Cook and Waterway Wireless, Inc. in Miami-Dade County, alleging negligence (Allen v. Fernandez Cambiaso, No. 2023-003653-CA-01, Eleventh Judicial Circuit). Marcos Fernandez Cambiaso had been driving a 2018 Tesla Model X, and the complaint identifies its owner as Waterway Wireless, Inc., a Florida company whose president is Christopher Cook. A second lawsuit, which Waterway Wireless, Inc. filed against its insurer, Garrison Property & Casualty Insurance Company (USAA), in September 2025, describes how Marcos Fernandez Cambiaso came to be driving the car. According to filings in that case, Christopher Cook had given the Tesla to Marcos Fernandez Cambiaso, whom the filings describe as his employee, but the title had not been transferred by the time of the crash, and the two sides dispute whether the policy covers the injuries (Waterway Wireless, Inc. v. Garrison Property & Casualty Insurance Co., No. 2025-018350-CA-01).
Florida corporate records show that Marcos Fernandez Cambiaso also formed a company, Voltvision LLC (L24000297257), in July 2024, and it is still active. Marcos Fernandez Cambiaso is listed as both its sole manager and its registered agent, and in both entries his name carries the suffix “TR.,” which may indicate that he acts as a trustee. If so, Marcos Fernandez Cambiaso holds Voltvision LLC on someone else’s behalf.
The car insurance policy at issue in the lawsuit lists eighteen vehicles and multiple named drivers, among them Marinna Dawn Kus, who based on sources was Christopher Cook’s former girlfriend, whom Christopher Cook broke up with to begin a relationship with a flight attendant Sarah O’Grady Kelley who is documented as being on Christopher Cook’s payroll based on records reviewed.
According to sources with direct knowledge, Anthony “Tony” Timmons has for some time been a highly compensated consultant to Exacore, Christopher Cook’s rebranded mining operation, with monthly fees paid to TTW LLC, an entity we understand Anthony “Tony” Timmons owns. That means Exacore money is going to a man named as a defendant in a Texas lawsuit alleging a conspiracy to sell unregistered securities. In January 2024, S&T Oilfield Services LLC filed suit in Travis County district court (Cause No. D-1-GN-24-000336) naming Timmons among a group of defendants accused of conspiring to sell unregistered securities. The petition alleges that S&T wired $1 million in May 2021 for a convertible promissory note in a venture called DigitalGrid, pitched as a Bitcoin mining operation (yes!!!) that would run on flared gas at oil wells and yield 48% gross margins in its first year; that the note promised repayment in full within two years or conversion into shares; that investors received neither; and that when the investor asked after its money, it was told it had made a bad investment and the funds were lost. The petition further alleges that Anthony “Tony” Timmons made the introduction that brought the investor in, and that he began drawing a $100,000 salary from the venture only after the investor’s money arrived. Anthony “Tony” Timmons is associated with HampTex Capital Partners LLC, which deserves close scrutiny in our view.
Among the vendors drawing money out of Blockstream Mining/Exacore is a Florida party lighting company called Light Up the Night LLC, owned, according to state records, by three men, Elimelech Goldshtein, Isaac Benharoche, and Troy M. Cabrera, through personal holding companies. According to sources, Light Up the Night LLC has been paid millions of dollars by Exacore, for datacenter construction. Light Up the Night is, as its name suggests, an event lighting company. Nothing in its public footprint that we could find suggests any history of datacenter design, electrical infrastructure at industrial scale, or construction of any kind beyond staging events. We understand Elimelech Goldshtein has a very close relationship with Christopher Cook.
Among the personal expenditures we have traced to Christopher Cook who runs Blockstream Mining is a $3.6 million Manhattan apartment purchased by Christopher Cook for Natalie Belluccia (aka Nati Belluccia) held under MAISON TROIS LLC, an Instagram model and registered nurse who accompanied Christopher Cook to Monaco on a fundraising trip. According to sources, Natalie Belluccia also received recurring payments from Christopher Cook of over $5,000 a month. We note the apartment purchase as part of the pattern of personal asset acquisition documented elsewhere in this investigation. Natalie Belluccia maintains a public profile as a social media personality, with more than 214,000 followers on Instagram (@belluccia).
Pete Rizzo, associated with Bitcoin Magazine (BitcoinMagazine[.]com), has produced consistently favorable coverage of Adam Back, including a stream of hyping posts on X.com (formerly Twitter). Bitcoin Magazine, which is controlled by David F. Bailey, whose Nakamoto company (NAKA) Adam Back invested in and whose UTXO Management holds a position in Capital B, the French Bitcoin treasury company Adam Back fronts. We are not aware of these relationships being disclosed to readers of David F. Bailey’s Bitcoin Magazine. Readers can judge whether Pete Rizzo’s over the top positive coverage of Adam Back is independent or not.
BitcoinTreasuries[.]net, another website associated with Pete Rizzo and BNET Media Inc., has also covered Adam Back and Samson Mow extensively and favorably. Readers can judge for themselves whether that coverage is independent.
Then there is Jason Maurice (aka wiz on X.com formerly Twitter) of the Mempool Open Source Project. In Part 1 of this investigation, published on June 8, 2026, we flagged that the Mempool[.]Space dashboard for Liquid Network (hosted on Liquid[.]Network) had shown L-BTC at ~82% collateralized in January 2026, ~3,463 actual Bitcoin backing 4,199 L-BTC in circulation, before the display went blank with “Indexing in progress.” Adam Back had, at the time, quickly blamed outdated software.
According to sources familiar with Blockstream’s Liquid Network, the security model behind L-BTC has been questioned inside Blockstream itself for some time, along with the integrity of the hardware security modules that underpin Blockstream’s Liquid Network.
After our investigation went viral, on June 22, 2026, Jason Maurice (@wiz) produced a convenient corroboration defending Blockstream. Adam Back retweeted it, and it became the standard "debunk" trotted out when others raised our concerns about Blockstream's Liquid Network and Liquid Bitcoin (L-BTC). Jason Maurice did not disclose in the post that he is a member of Blockstream’s Liquid federation, the group of parties that jointly holds the Bitcoin backing L-BTC. He was reassuring the market about the reserves while presenting the Mempool Open Source Project as an independent voice. A few months later a hacker drained nearly 4,000 Bitcoin from the federation Jason Maurice sits in (85% was later returned).
Then there are the brothers Austin Hill and Hamnett Hill Jr., whose ties to Adam Back predate Blockstream. Austin Hill and Hamnett Hill Jr. co-founded Zero-Knowledge Systems, a Montreal “privacy company” founded during the height of the dot-com boom, with their father, Hamnett “Hammie” Hill Sr., in 1997, with Austin Hill as CEO and Hamnett “Hammie” Hill Jr. as COO. Austin Hill later co-founded Blockstream and served as its first CEO (author’s note: Blockstream has quite a few “co-founders”). In October 2016, Blockstream announced that Austin Hill had stepped down from the board and that Adam Back would replace him as chief executive. Blockstream said Austin Hill left to pursue other opportunities. But according to people familiar with the matter, Austin Hill was forced out of Blockstream after showing up to the office drunk on multiple occasions (and drinking alcohol while at the office), we believe. Austin Hill has since resurfaced in Florida and became involved with Machine Phase Systems Inc., a nanotechnology startup led by fellow Blockstream co-founder Mark Friedenbach. Austin Hill has described the company as “pioneering atomic-level manufacturing,” and the company was reportedly raising funds for technology that, in our view, remains highly speculative and seems to defy the laws of physics. Austin Hill’s X.com (formerly Twitter) profile now describes him as “ex Machine Phase Systems” and a co-founder of a company called Elementa. Hamnett “Hammie“ Hill Jr. has been listed in at least one business database as a former Blockstream CFO, and several technical indicators still tie him personally to Blockstream.
Francesca Hall’s path leads back to the Hill brothers. When Blockstream launched in 2014, Francesca Hall was named among its co-founders, with the title of team coordinator, though her role actually began as executive assistant to Austin Hill. She is, we understand, one of the core operating members of Blockstream Inc. and one of its longest-serving employees, with a significant role in managing the company and its operations as well as Adam Back’s media, though her LinkedIn profile lists her more modestly as a Compliance Associate at Blockstream. After Austin Hill’s departure, according to a source who worked with Francesca Hall, she “remained as the main organizer of things.” The source described her as very efficient and organized and credited her with helping organize media events for Blockstream. Francesca Hall was also described as “very liberal.”
Vikas “Vik” Mittal of Meteora Capital, based in Florida, is an individual who committed to invest in the BSTR deal. Vikas “Vik” Mittal stated he never indicated he would vote against Adam Back’s merger. Vikas “Vik” Mittal stated he wished Adam Back’s BSTR deal would be restructured. Vikas “Vik” Mittal privately vehemently defended Adam Back and the logic of the deal, insisting it was legitimate and not a fraud. Vikas “Vik” Mittal has a large following among SPAC investors and has actively sought publicity for himself and Meteora Capital, including through media appearances and social media.
Feel we missed someone who should be listed here? Perhaps they are a cooperating source helping expose serious conduct.
Do you know something we don’t? We’re looking to hear from current and former employees of Blockstream, Exacore, and STOKR, and from anyone who has worked with, invested alongside, or lent money to Adam Back, Samson Mow, or Christopher “Chris” Cook. We can share what we’ve found that isn’t in this piece, and we protect our sources. Visit our website NatInfoSec.com and email us at nat@natinfosec.com.
The “We’ll Give You Your Money Back” Head Fake
In late June 2026, as questions about the Bitcoin mining note investment program grew louder thanks to our efforts, Blockstream Mining Note (BMN) investors got a confidential update with what looked like a generous offer, redeem early and get your original investment back (which if one is familiar with the investor terms is in and of itself nonsensical).
Read the fine print and the absurdity of the offer becomes obvious. It isn't a binding offer. The document terms it a "call to an expression of interest," open for 60 days, i.e., non-binding. Nowhere does it identify where the money would come from. There is no payment date. Nobody has set up an escrow arrangement, and the document never explains how investors would actually surrender their notes. Investors are invited to raise their hands, and Blockstream is not obligated to pay them anything. By the update's claimed numbers, each note had mined about $21,150 of Bitcoin against a claimed value of $46,497, so refunding everyone would take serious cash from somewhere other than Bitcoin mining. The fact that these BMN investments are non-recourse but Blockstream is offering to refund the investors 100 cents on the dollar should give people pause! It's puzzling for anyone with a basic grasp of finance.
The verbiage of the update is also quite telling, with Adam Back appearing just once, in a carefully worded line stating he “retains a minority ownership interest” while insisting he “holds no operational or management role.” This is the man whose name and Satoshi legend sold the Blockstream Mining Notes in the first place. Now that the bills are due, investors learn the front man is a passive minority holder who owes them nothing. We believe the update was written with ChatGPT with several obvious tells, another thing that should raise doubts.
Christopher Cook appears nowhere at all in the investor letter! A convicted financial fraudster, whose role Bloomberg has confirmed, is not named once in a multi-page letter about that business. The letter is signed by “BMN Operations,” and the only contact is a legal inbox in Luxembourg tied to STOKR run by Arnab Naskar.
The September 6 hack and halting of Blockstream’s Liquid Network makes the offer more implausible. BMN notes are traded on Liquid Network and settled in L-BTC, and Liquid Bitcoin has been halted since the exploit. As long as the network stays functionally paused and L-BTC is unbacked the offer can conveniently be delayed.
What We Did
We spent several months investigating Adam Back’s companies. On June 8, 2026, we exposed the troubling facts about Adam Back’s fundraising, and the billions in undisclosed liabilities at Blockstream. Ahead of the shareholder vote scheduled for June 26, investors committed to fund Adam Back’s stock market deal (BSTR) learned of these serious red flags through our work, in most cases for the first time.
In the weeks that followed, the vote for Adam Back’s stock market listing was postponed on June 24, postponed again on June 30, and then shelved. On July 8, the original merger terms were scrapped amidst threats of lawsuits, and on August 20 the listing was terminated entirely. Adam Back and Samson Mow attributed the failure to market conditions. Both Samson Mow and Adam Back released statements that, in our view, were highly misleading about what had happened with their failed stock market listing.
On June 24, the shareholder vote was postponed. According to sources familiar with the matter, the delay followed threatened legal action against Adam Back over alleged fraud and material breaches in the stock market listing deal for Adam Back’s BSTR. The next day, Samson Mow posted: "Nothing stops the BSTR train." Over the following days, Samson Mow posted detailed calculations of how much Bitcoin BSTR's $1.5 billion could buy, and suggested that Strategy (formerly MicroStrategy) sell BSTR 25,000 Bitcoin directly. On June 26, Samson Mow reminded followers the vote would take place on July 2. It was postponed again at the last minute.
On July 8, Adam Back’s stock deal fell apart. That day’s announcement said the merger would not go ahead on the agreed terms, the investors who had promised $1.5 billion to buy more bitcoin were released from their commitments, and the shareholder vote was postponed indefinitely. Adam Back’s tweet about it left all of that out! He mentioned only they were discussing a revised deal, and he reworded the reason. The official release said new terms were needed to “better reflect current market conditions,” a polite way of saying the market had turned against them. Adam Back’s version said the new structure was meant to “opportunistically better capitalize on market conditions,” as if they had spotted a chance to do an even better deal.
Two weeks later, on July 22, Samson Mow insisted "BSTR did not implode" and dismissed our investigation as "horrible conspiracy pieces." In the same post thread on X.com (formerly Twitter), Samson Mow acknowledged that "the CEPO merger is cancelled." Thirty-five minutes later, he argued that talks on a revised deal had to be real, because "if this was a full, final cancellation with no ongoing talks, they could not have said this." On August 19, Samson Mow posted: "BSTR is coming." The next day, the deal was fully terminated, and Adam Back's side agreed to pay Cantor's SPAC $15 million to walk away. BSTR's own announcement blamed "significant pricing pressure amid challenging market conditions."
Samson Mow also told his followers on June 25 that he had “no affiliation with BSTR other than I like the stock.” According to a source with knowledge of the arrangements, Samson Mow was one of the people who raised BSTR’s private money outside the SPAC.
Readers can weigh the sequence and our role in it for themselves, and decide who pumped the brakes on this theater of absurdity. People say "crime is now legal." We hope to have made clear that crime is only legal if it is allowed to be through fecklessness, apathy, and laziness (we say this while noting that the ideal amount of deviance in society from a sociological perspective is not zero).
Do you know something we don’t? We’re looking to hear from current and former employees of Blockstream, Exacore, and STOKR, and from anyone who has worked with, invested alongside, or lent money to Adam Back, Samson Mow, or Christopher “Chris” Cook. We can share what we’ve found that isn’t in this piece, and we protect our sources. Visit our website NatInfoSec.com and email us at nat@natinfosec.com.
Lawsuits Piling Up
While Blockstream Mining Note holders wait for refunds and Liquid Network users cannot withdraw, creditors have gone to court to get their money. With many lawsuits filed against Blockstream, Exacore and Christopher Cook. We expect a lot more.
On August 26, 2026, Xcel Energy filed a lawsuit against Exacore, LLC in the 47th District Court of Potter County, Texas (Cause No. 113893-A-CV).
Xcel says in the lawsuit it supplied electricity to Exacore’s site at 2485 County Road 20, Unit PME, in White Deer, Texas, and that Exacore did not pay for the power. The past-due balance is $1,137,011.99, and Xcel sent a demand letter on June 26, 2026 before filing the lawsuit.
The exhibit attached to the petition sets out the electricity the site was consuming. Account Statement #975979468, dated April 30, 2026 and due May 18, 2026, records 8,621,901 kWh of consumption and a daily average electricity cost of $20,604.08. For the same period a year earlier, the daily average was $0.00. So the site was drawing power at scale by the spring of 2026, and the company could not pay for it. Based on sources the power was being resold to hosted mining clients at a loss.
Electricity is the largest operating cost of a Bitcoin mining business, and a functioning miner pays their electricity bill on time, because the Bitcoin mining machines stop earning the moment the electricity is cut. Exacore (aka Blockstream Mining) is more than a million dollars behind on its power bill.
On September 11, 2026, River Financial Inc. sued Blockstream Services Canada, ULC in federal court in San Francisco (River Financial Inc. v. Blockstream Services Canada, ULC, No. 4:26-cv-10252, N.D. Cal.). According to the complaint, River prepaid about $7.75 million in 2022 for Blockstream to host its Bitcoin mining machines for five years. In December 2024 the two sides agreed to end the arrangement early (many hosted miners using Blockstream Mining have come to regret the decision based on human sources). Under that termination agreement, Blockstream agreed to return $3,549,303.41 of River’s prepayments and pay a $3,145,317.24 early termination fee, at about $240,000 a month, starting August 2025.
The agreement was signed for Blockstream by its President, Christopher Cook. In it, Blockstream represented that the prepayments “were and are property of the Customer,” that it was not insolvent, and that it had sufficient funds to make the payments.
River alleges that Blockstream stopped paying on March 31, 2026, the same month as the $443 million Blockstream Mining Note redemption described above, and missed every payment after that. River also alleges that Blockstream acknowledged the debt in writing in May 2026. The agreement also lets River declare the entire remaining balance due at once.
Christopher Cook’s Private Plane Payment Default: On August 7, 2026, MSP Recovery Aviation, LLC filed a lawsuit against Christopher Cook (Filing No. 254410288).
The lawsuit concerns a business jet: a Boeing 767-238, serial number 23402, formerly registered as N267JR (Christopher Cook reassigned it the tail number N69DD). The widebody airliner spent its working life carrying passengers for Qantas before being converted into a private plane in 2022 for the Miami attorney John H. Ruiz, founder of MSP Recovery. The plane seats 33 and sleeps 16. Christopher Cook was buying what has been described as a flying mansion and a work of art.
On August 14, 2025, Christopher Cook’s Knight Sky II bought the aircraft and gave MSP Recovery (the seller) an $11,000,000 promissory note, repayable at $200,000 a month at ten percent. Ten percent on $11 million is about $92,000 a month in interest, so each installment retired only around $108,000 of principal. The same day, Christopher Cook signed a Continuing Guaranty in which he "absolutely and unconditionally guarantee[d]" every obligation of Knight Sky. That is a guaranty of payment rather than of collection, so MSP can come at Christopher Cook personally without first chasing the company or the plane.
The payments were late almost at once. The complaint says the November 2025, December 2025 and January 2026 installments were each paid only after the grace period expired, triggering a $20,000 late charge each time. The February 2026 installment of $200,000 was not paid at all. On March 4, 2026, MSP declared default, accelerated the loan, and demanded $11,046,284.37, more than the original face amount.
Bot Accounts Helping Adam Back on X.com (formerly Twitter)
After Adam Back’s stock market listing collapsed amidst allegations of fraud, after our investigation began raising serious questions, a wave of strangely similar posts appeared on X.com (formerly Twitter). In just 76 minutes, at least twelve accounts posted weirdly positive sounding news about Adam Back and the BSTR stock market listing collapse. They are obviously spam Tweets meant to put out a pro Adam Back narrative amidst the stock deal’s collapse:
“SPAC deals falling apart is never a great look, but honestly? Adam Back walking away to find better terms shows discipline.”
“Renegotiating SPAC terms is never a great look… but honestly, if anyone can pull off a serious BTC treasury play it’s Adam Back.”
“SPAC deal falling apart is never a great look, ngl. But Adam Back knows what he’s doing.”
The accounts don’t look like real people. Their handles are weird (@nut_grafvlpp, @PraxisProtckqe, @Temple_Barvpqm), their names have nothing to do with Bitcoin, and several have since been deleted.
In plain English: this is platform manipulation, fake accounts posing as ordinary people to make an opinion look popular. X’s own rules ban it. Most of the posts spun the news in Adam Back’s favor, the kind of fake grassroots cheerleading known as astroturfing.
A warning: Paying for or running fake accounts to promote an investment is not harmless marketing planned among friends in a chat group (yes, even in crypto). When such coordinated posts concern a publicly traded company, such as Cantor Equity Partners I (CEPO), which was listed on Nasdaq at the time, a coordinated media campaign of this kind can amount to market manipulation and securities fraud under US law (yes, even now). Anyone who organized, paid for, and took part in Twitter posts promoting such narratives should understand the legal and financial risks they are taking.
We have identified individuals and chat groups we believe coordinated these pro-Adam Back spam posts, and may publish our findings soon.
A Detail On The Blockstream Hack, Liquid Network User Funds Frozen For Over 2 Weeks & The Mutiny Attempt That Failed
In the first few days after Blockstream’s Liquid Network was hacked on September 6, a tidy but erroneous explanation of how the hack happened formed. Blockstream had found a bug in the software Liquid runs on and fixed it quietly, but the fix landed on public GitHub before any release shipped. An attacker read the diff, reverse-engineered the vulnerability, and went after node operators who had not yet upgraded, with SideSwap the operator most people assumed had fallen behind. In this account, the hack was a textbook patch-diffing attack and a lesson about deployment lag.
That account gets the central fact backwards. The attacker exploited machines running Blockstream’s fix (the new code), and the fix is what let the attacker create L-BTC out of nothing and steal funds belonging to Blockstream’s users, while machines still on the older code rejected the attack.
Blockstream’s post-mortem says that all fifteen functionaries, the nodes that sign Liquid blocks and control the bitcoin reserve, were running the same new patched software by September 6, and that new software pushed out by Blockstream accepted the counterfeit transaction. As did the security build SideSwap says it installed on August 13 at the request of the Liquid Federation. The liquid[.]network explorer, reportedly still on the older 23.3.2 release, rejected the block containing the attacker’s transactions.
The attacker may have studied the September 1 GitHub commit, but the commit would need to have led them to a new hole in the fix itself rather than to old code on outdated nodes. According to SideSwap, the fix was merged under a title that described the vulnerability, before any release contained it. By publishing the patch in that form, Blockstream may have shown the attacker where to look.
A thread in SideSwap’s timeline is worth noting. Between September 1 and 5, SideSwap says, a few wallets made repeated small round trips through its service, pegging bitcoin into Liquid, selling the L-BTC on its market, and pegging back out, activity SideSwap describes as practice runs. One of those wallets had been funded in April 2025 through regulated exchanges and then sat untouched for seventeen months until its first spend on September 1, the day the fix appeared on GitHub.
Blockstream’s post-mortem says repeatedly that no reviewer, internal or external, identified the vulnerability before it was exploited. That is hard to make sense of for a bug this trivial to pattern-match and find. It is harder still if highly placed sources are correct that many members of Blockstream’s Liquid Network Federation had known about the core bug since at least June 2026, months before the hack; in that case, the post-mortem’s claim that no warning was ignored does not hold.
A flaw that lets a node accept an invalid range proof threatens far more than a network split. Assets on Liquid Network are hidden, and Blockstream says no separate off-chain reserve check happens at peg-out, so the flaw could let an attacker print L-BTC and redeem it for real bitcoin. A risk of that size justifies pausing peg-outs, or the network itself, while the fix is written carefully and then attacked with automated scanning, fuzzing, and adversarial review before it reaches production. A halt would not have repaired a bad patch by itself, although it would have removed the time pressure. The irony is that the network has been functionally halted for users since September 6, with no concrete date by which bitcoin redemptions will begin.
The Federation could halt the network, and on September 6 it did, hours after the counterfeit L-BTC was minted. Blockstream states its monitoring had flagged a stall in block production at 14:10 UTC, eighteen minutes before the Federation released the bitcoin to the hacker. The post-mortem never addresses who at Blockstream had this information, or when. We hope others pull on this thread.
The public narrative begins on September 1, when the fix appeared on GitHub, but the new, vulnerable code had been circulating for weeks by then. By Blockstream’s own account, thirteen of the fifteen functionaries were running the patched build by August 11, and SideSwap says a security build was shared privately with Liquid members on August 12. Anyone holding that build could have compared it with the previous release, identified the original bug and its fix, and found the flaw in the fix nearly three weeks before the public could.
The attacker has returned ~3,400 BTC. Based on blockchain data, ~600 BTC is still held by the attacker, and owing to this deficit and Blockstream's inability to fill the hole, all user bitcoin remains functionally frozen. Meanwhile, absurd conspiracy theories are being posted by Samson Mow, stating to the effect that real users can in fact withdraw their funds and that a cabal of astroturfing users is spreading misinformation about user funds being frozen.
Who makes decisions about Blockstream’s Liquid Network has been a point of friction inside the Federation for some time. According to two people who have seen many of the functionaries in operation and attended meetings of disaffected Liquid Network members, Liquid has drifted into a hybrid that is neither a Blockstream product nor an open protocol governed by its members. The member businesses that run the network’s infrastructure carry the operational burden, while its revenue and control over its technical direction stay with Blockstream. Members have little formal say over what gets built, the sources say, and their requests tend to go nowhere.
Feature requests stalled as a result. Tether, for example, had pushed for changes to better support its USDt token on Liquid, including letting users pay network transaction fees in USDt rather than L-BTC, among many other requests.
In March 2026 a group of Liquid Network Federation members met in Viareggio, Italy, to force the issue. Sources who were present described the gathering as a mutiny attempt. By this account, those pushing hardest included Arnab Naskar of STOKR, which uses Liquid to issue tokenized securities and notes (like the Blockstream Mining Note, Hah!); Eduardo Jatahy, a Brazilian Federation member associated with DePix; Marco Argentieri of Ark Labs; and Claudio Levrini of Chimera Wallet. Their message was that they would leave Liquid unless Blockstream handed governance to the members. Samson Mow reportedly pitched a native token (similar to HYPE on Hyperliquid) in what sources described as a deceptive manner. The meeting, sources said, ended without any changes.
Reportedly, based on sources many members of Blockstream’s Liquid Network are in the process of leaving.
Private Jet Fire Sale? Gulfstream G650 (N69DJ) Goes Up For Sale
Christopher Cook is trying to sell one of his aircraft. The Gulfstream G650 registered as N69DJ, held through Knight Sky III LLC, is on the market, according to human sources.
The aircraft is one of at least three private jets Christopher Cook flies on.
Anyone considering buying this aircraft, and any escrow agent, title company, or lender working on the transaction, should understand what they are dealing with. We have traced more than $442 million in personal asset purchases by Christopher Cook over three years, during a period in which he was a salaried executive and Blockstream Mining vendors and investors were going unpaid. Where assets are later found to have been bought with misappropriated funds, purchasers can face clawback and voidable-transaction claims from creditors and from any receiver or trustee eventually appointed. These questions are now public, and a buyer who proceeds does so on notice!
We would encourage any party approached about buying this aircraft to conduct enhanced diligence on the source of funds used to acquire it, and on the criminal background of the ultimate beneficial owner.
What’s Next…
We expect further developments soon. We hope that investors in TOBAM in France, Sygnum Bank in Singapore and Switzerland, Bank Frick, Swissquote Bank, Petrushev Capital, Abraxas Capital and Capital B, Societe Generale Group, Potter Opportunity Fund, Moonlight Capital, Compass Mining, Makkaba Industrial Partners along with users of Samson Mow's Aqua Wallet and Bull Bitcoin and anyone holding L-BTC or other Blockstream Liquid network assets, will look closely at the facts we have laid out. Despite public claims by Bull Bitcoin, Aqua Wallet and others, Bitcoin held on Blockstream’s Liquid Network was always custodial (trusted to someone else, not under the user’s control). With the network now halted and L-BTC unbacked, it is unfortunate that the warnings we issued months ago were not more widely reported at the time.
We are aware of extensive efforts by specific employees of Avisa Partners (Forward Global) to find out how we built such a detailed picture of Blockstream. French media outlets have reported on Avisa Partners' covert online influence campaigns for corporate and government clients. Gasthalter & Co. has also been trying to look into us. We have noted both. In light of what we have published so far, we hope both firms examine where the money paying them comes from and carry out proper due diligence on their clients.
If you are an investor in any Blockstream-related investment, or if you have lent Bitcoin or cash to Adam Back, Samson Mow, Christopher “Chris” William Cook or Fulgur Ventures please email us nat@natinfosec.com.
If you’re a Blockstream, Exacore or other Adam Back related company employee please do reach out via email! There’s more to this.
Made it this far? Wow! Thank you for reading a 12 page investigation. Do you want to learn more about this? Please visit our website NatInfoSec.com and get in touch with us or email us at nat@natinfosec.com.
This tracks with a different piece of the same story that doesn't usually get asked about: Blockstream's small-block position on Bitcoin's base layer predates BMN, but it's the same underlying pattern — a company whose revenue depends on Bitcoin's capacity staying constrained (Liquid, mining, now BMN) also happened to employ several of the most influential voices arguing to keep it that way. Cook and the mining-note structure you're covering here isn't a one-off, it's the same incentive showing up again. Put together a sourced timeline of the block-size side of it if useful: bit-coin.co.uk
For what it's worth ... I think this statement is misleading:
"Aqua Wallet, which parks users’ Bitcoin as Liquid Bitcoin (L-BTC) on Blockstream’s Liquid Network (without making it obvious to users that they were not holding real Bitcoin, but an IOU from Blockstream)"
First, every custodial Bitcoin balance is an IOU.
Second, Aqua has separate balances for Bitcoin and Liquid Bitcoin. They don't represent Liquid Bitcoin as regular Bitcoin and they don't take your Bitcoin balance and automatically convert it to Liquid. At least, I can say that was my experience. Because your statement gave me some doubt, and I believe implies that my Bitcoin balance would be frozen, I sent Bitcoin from my Aqua Bitcoin balance to another Bitcoin wallet on chain. It worked fine, and fast.