Blockstream Refuses Ransom Demand After Liquid Hackers Retain Nearly 600 BTC

Blockstream announced it will not meet the ransom demands of the actors who compromised the Liquid Network, a Bitcoin sidechain, and will instead work with law‑enforcement and forensic specialists to try to recover the remaining assets.

Hackers’ demands and Blockstream’s response

The attackers posted an on‑chain message demanding a 10% bounty from Blockstream’s own funds, warning that Liquid holders could suffer a 15% loss if the demand was not met. Blockstream called the act “theft” and rejected the notion of “white‑hat” activity, stating it will not pay the ransom.

Extent of the loss

After a pause in operations, the Liquid Network reported that roughly 4,000 BTC were withdrawn from its federation wallet. Following a patch to affected bridge nodes, the hackers returned about 3,400 BTC, leaving an outstanding balance of approximately 598 BTC.

Next steps for recovery

Blockstream said it will cooperate with law‑enforcement agencies, exchanges, service providers and forensic experts to trace the stolen Bitcoin and identify the perpetrators. The company also urged the hackers to voluntarily return the remaining funds.

Current status of the Liquid Network

Liquid resumed block production, generating empty blocks after emergency software updates. However, transactions and Bitcoin transfers to and from the network remain suspended.