Summary
- Blockstream announced it will not "pay a ransom" for the recovery of approximately 598.5 BTC still unreturned after the Liquid Network hack.
- Hackers returned 3,400 BTC on Monday, which amounts to around 85% of the total taken.
- The firm plans to collaborate with law enforcement, exchanges, and forensic experts to recover the remaining funds if necessary.
Blockstream has made it clear that it will not comply with ransom demands for the return of $47 million in Bitcoin stolen from its Liquid Network, ending negotiations with the perpetrators.
On Friday, the company stated, "Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft," emphasizing their stance against paying the ransom.
To the individuals responsible for the theft of bitcoin from the Liquid Network:
Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is…
— Blockstream (@Blockstream) September 11, 2026
Approximately 4,000 BTC was drained from the sidechain on Sunday, valued at around $320 million. The hackers returned 3,400 BTC on Monday, leaving 598.5 BTC still in the address they transferred it to, where it remains untouched.
The exploit was facilitated by a vulnerability in how Liquid nodes cache range proof verifications, which allowed the attackers to mint unsupported L-BTC and exchange it for reserve Bitcoin via SideSwap, a federation member with a peg-out authorization key. The reserve subsequently dropped to 197 BTC. Blockstream managed to patch the bridge nodes within ten hours and released Elements v23.3.4 on Wednesday. Liquid resumed block production and transaction processing on Thursday, although peg-outs remain disabled as a safety measure while "the final stage of recovery" is underway. The company also issued a warning about scammers targeting node operators with fraudulent update sites.
Myriad: Predict Bitcoin's next move.In a report on Tuesday, Liquid expressed a different sentiment, indicating it was working "with the white hat hacker" to restart the network.
Blockstream clarified that their involvement in these discussions "should not be mistaken for acceptance of the actions taken nor of the terms being demanded." Those terms were made public in a Bitcoin transaction on Wednesday, where the hackers claimed Blockstream had allocated "only $1.5M (possibly even 0) to secure $5B assets," describing it as "a flagrant neglect of security." They demanded 10% "using your own money as bug bounty," warning that failure to comply would result in a 15% loss for all holders due to Blockstream's "irresponsibility and stinginess."
A Precedent Blockstream Refuses to Set
Blockstream asserts that it will not become "a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation."
Additionally, it stated that it will not cover losses incurred by users. "Bitcoin is hard money and can't be minted without costs," the company noted. "Bitcoin doesn’t haircut users to pay a ransom." Instead, Blockstream will explore "every lawful avenue" with law enforcement, exchanges, and forensic experts if the funds are not returned. "Transactions do not disappear, and neither does the evidence they leave behind," it concluded, urging, "Return the bitcoin."