Blockstream Refuses Ransom After Liquid Network Bitcoin Exploit

Blockstream announced on Sept. 11 that it will not pay a ransom demanded after the September 6 exploit of the Liquid Network that resulted in the unauthorized creation and withdrawal of roughly 4,000 BTC.

Exploit details

The attack leveraged a flaw in the Elements software used by Liquid nodes, specifically how range‑proof verifications were cached. This allowed unbacked Liquid Bitcoin (L‑BTC) to be accepted as valid and subsequently pegged out to Bitcoin, releasing about 4,000 BTC.

Recovery progress

Liquid reported that on Sept. 7 the actors returned 3,400 BTC to the federation peg wallet. As of the Sept. 8 update, approximately 598.5 BTC (about 15% of the total) remained outstanding.

Transactions on the network resumed on Sept. 10, but peg‑outs – the mechanism for moving Bitcoin out of Liquid – stayed disabled while recovery work continued.

Blockstream’s response

Blockstream rejected the actors’ claim of “white‑hat” activity, stating that taking assets without authorization and withholding their return constitutes theft. The company said it will cooperate with law enforcement, exchanges, service providers and forensic specialists to trace the remaining funds.

Mitigation

Liquid released an emergency Elements v23.3.4 update on Sept. 9 that patches the proof‑verification cache vulnerability.