Blockstream Stands Firm Against Ransom Demand for 598 BTC Stolen in Liquid Network Breach

TLDR

• Blockstream has taken a firm stance against paying ransom demands for approximately 598.5 BTC retained by exploiters after the Liquid Network breach
• The initial exploit saw nearly 4,000 BTC drained from Liquid’s federation wallet on September 6, 2026
• Following Blockstream’s security patch, approximately 3,400 BTC was sent back, leaving roughly 15% still missing
• The exploiters issued an ultimatum: pay them a 10% bounty from company coffers or Liquid users face a 15% permanent loss
• The company has committed to pursuing recovery through law enforcement cooperation, exchange partnerships, and blockchain forensics

Blockstream has taken a definitive stand against paying ransom to exploiters who continue to hold roughly 598.5 BTC following the Liquid Network security breach. The Bitcoin infrastructure company has labeled the retention of funds as outright theft and vowed to pursue recovery through legal and investigative means.

The security incident unfolded on September 6, 2026, when individuals identifying as “whitehats” extracted close to 4,000 BTC from the federation wallet on Liquid. The stolen amount represented approximately $320 million in value at that moment.

Liquid operates as a Bitcoin sidechain developed and overseen by Blockstream. Following the unauthorized withdrawal, network operations were halted while technical teams investigated and addressed the security flaw.

The root cause was traced to a cache-key collision within the confidential transaction verification system. Blockstream assured users that the federation’s cryptographic keys remained secure and were not breached.

Once Blockstream deployed fixes to the compromised bridge infrastructure, the exploiters sent back 3,400 BTC to the federation’s address on September 7. This represented approximately 85% of the total funds extracted.

However, the remaining 598.5 BTC remained in an address under the exploiters’ control. At the time of this partial return, the retained coins held a value approaching $47 million.

The situation escalated when the exploiters modified their position. Using blockchain messaging, they issued an ultimatum requiring Blockstream to pay a 10% bounty from corporate reserves. The alternative, they threatened, would be a permanent 15% loss for all Liquid users.

Blockstream Issues Firm Rejection

On September 11, Blockstream issued an unambiguous response via X, declaring it would not negotiate or pay ransom for stolen assets. The company challenged the exploiters’ characterization of their actions as legitimate security research.

“Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft,” the company stated.

Blockstream further contended that requiring open-source maintainers to pay substantial ransoms after code exploits sets a dangerous precedent, especially when those developers have no financial interest in the affected network.

The firm acknowledged previous communication with the exploiters conducted in good faith but emphasized that such dialogue never constituted acceptance of the theft or agreement to any payment terms.

What Happens Next

Blockstream has left the door open for the exploiters to voluntarily return the Bitcoin and adhere to genuine white-hat disclosure practices. Failing that, the company intends to activate a comprehensive response involving law enforcement agencies, cryptocurrency exchanges, service providers, and blockchain analysis firms.

The transparent nature of Bitcoin’s blockchain enables ongoing surveillance of fund movements from the compromised addresses, regardless of attempts to fragment holdings across multiple wallets.

Blockstream referenced the investigation following the Coldhead exploit as precedent, where Galaxy Research documented 1,561 BTC remaining frozen after attacker addresses were distributed to exchanges and compliance organizations.

The Liquid network restored block production on Thursday after implementing emergency patches, though transaction capabilities and Bitcoin bridging operations remained offline at publication time.

Blockstream expressed gratitude to the Bitcoin community and assured affected users of continued efforts toward full fund recovery, while thanking the engineers, cryptography experts, and security professionals who contributed to resolving the vulnerabilities.

“Transactions do not disappear, and neither does the evidence they leave behind,” the company stated.