Blockstream has refused to pay a ransom for bitcoin stolen from the Liquid Network, its federated Bitcoin sidechain, in a statement posted to X on September 11 . The declaration follows a September exploit in which purported white-hat hackers withdrew roughly 4,000 BTC, worth about $320 million, from the network’s federation reserves by exploiting a flaw in its transaction-validation software. Most of the funds have since been returned, but roughly 600 BTC, about $47 million, remains under the attackers’ control.
Blockstream frames the withdrawal as theft
Blockstream said it will not pay a ransom for the return of stolen funds and described the incident as a crime rather than responsible disclosure. “Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity,” the company said. The Liquid Network was paused after the withdrawal, and if the remaining funds are not returned Blockstream said it will pursue “every lawful avenue,” working with law enforcement, exchanges, service providers and forensic specialists to trace and recover the assets.
How the exploit and partial return unfolded
According to blockchain analytics firm Chainalysis , the hackers exploited a flaw in the way Liquid cached transaction-verification checks, allowing them to create unbacked L-BTC and exchange it for real bitcoin. After Blockstream confirmed its bridge nodes had been patched, the actors sent back 3,400 BTC, roughly 85% of the amount withdrawn, in a single transaction. The remainder, sent as change to an actor-controlled address, has not been returned. Chainalysis noted that some observers have speculated the withheld funds amount to a de facto bounty, though neither side has confirmed such an arrangement.
A standoff that is still developing
Blockstream said there remains an opportunity to resolve the situation responsibly, but warned that Bitcoin’s transparency means the transactions and the evidence they leave behind “do not disappear.” The company pointed to the community of engineers, cryptographers and white-hat hackers that can help trace the funds, underscoring the scrutiny placed on the federated custody model that underpins Liquid. BlockchainReporter has previously examined a Liquid Network loophole and the network’s federated design. Whether the outstanding bitcoin is returned remains an open question as the standoff continues.
