Blockstream Refuses Ransom for Remaining Stolen Liquid Bitcoin

Blockstream has publicly declined to pay a ransom for the approximately 598.5 BTC that remain under the control of the actors responsible for the recent Liquid Network exploit.

Background of the Liquid exploit

On September 6, a vulnerability in the Liquid sidechain allowed attackers to withdraw nearly 4,000 BTC from the federation wallet, representing most of the reserve at the time. The flaw was traced to a cache‑key collision in confidential transaction verification logic, though federation keys were not compromised.

Partial recovery and actor demands

After Blockstream patched the affected bridge nodes and confirmed the fix, the actors returned 3,400 BTC on September 7, roughly 85% of the withdrawn amount. The remaining 598.5 BTC stayed in an address controlled by the attackers.

Initially, the actors described themselves as “white‑hats” and asked Blockstream to fix the vulnerability before returning the funds. Subsequent on‑chain messages shifted the terms, with the attackers demanding a 10% bounty paid from Blockstream’s own resources.

Blockstream’s stance

In an X post on September 11, Blockstream stated that taking assets without authorization and withholding their return constitutes theft, not responsible disclosure. The company emphasized that open‑source Bitcoin developers should not be forced to pay ransoms exceeding their economic participation in a project.

"We will not pay a ransom for the return of stolen funds," the statement read. "Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white‑hat activity. It is theft."

Next steps

Blockstream said it will continue to work with law‑enforcement agencies, exchanges, forensic specialists, and service providers to trace and recover the remaining Bitcoin. The public nature of Bitcoin transactions allows investigators to follow the movement of the funds even if they are split across multiple wallets.

The company also thanked security researchers who helped identify and patch the vulnerability, and warned that paying a ransom could set a precedent forcing open‑source developers to fund large payments after unauthorized withdrawals.