Blockstream Refuses Ransom After Liquid Network Hack

Blockstream says it will not pay a 10% bounty demanded for Bitcoin still held after the Liquid Network exploit and will pursue recovery with investigators.

Key points

Blockstream rejected the attacker's demand for a 10% bounty on the Bitcoin that remains outstanding from the Liquid Network exploit.
About 3,400 of roughly 4,000 withdrawn BTC were returned, leaving approximately 598.5 BTC still under the attacker's control.
Liquid deployed an Elements software fix and resumed transactions, while peg-outs remained disabled in the latest operational update.

Blockstream has rejected a ransom-style demand tied to approximately 598.5 bitcoin that remains outstanding after the recent Liquid Network exploit. In a September 11 statement, the company said it would not pay for the return of assets and would instead work with law enforcement, exchanges and forensic specialists to recover the funds.

A 10% bounty demand is rejected

The attacker had proposed keeping 10% of the remaining bitcoin as a bounty, according to reports from Cointelegraph and The Block that cited an on-chain message. Blockstream characterized the continued withholding of the assets as theft rather than a legitimate white-hat disclosure and said its earlier engagement had been conducted in good faith.

The dispute follows the September 6 withdrawal of about 4,000 BTC from Liquid, worth roughly $320 million at the time. Reuters reported that the network halted new transactions after the incident, while Blockstream and Liquid said the withdrawals were carried out through SideSwap's authorized peg-out role and did not result from compromised federation keys.

Most of the Bitcoin was returned

The person or group behind the exploit returned 3,400 BTC on September 7. The Block's updated account placed the balance still outstanding at 598.5 BTC, while Chainalysis described the remaining amount as approximately 600 BTC in its September 9 technical analysis.

That partial return reduced the immediate loss but did not settle the incident. Cointelegraph reported that the attacker warned of a larger loss for Liquid holders if the proposed bounty was refused, a condition Blockstream has now publicly rejected. The company's stated next step is to pursue recovery through investigators and participating exchanges rather than negotiate a payment.

The flaw affected Liquid's software layer

Chainalysis said the incident stemmed from a flaw in how Elements, the software underlying Liquid, cached range-proof verification results. A new invalid proof could reuse an earlier valid cached result, allowing unbacked Liquid Bitcoin to be created before real BTC was withdrawn through the network's peg-out process.

The technical distinction matters because Liquid is a Bitcoin sidechain used to move assets with different settlement features; it is not the Bitcoin base network. The available incident reports do not indicate that Bitcoin's core protocol was compromised. Instead, the exploit demonstrates how software and operational layers built around Bitcoin can introduce separate risks.

Recovery continues as service returns

Liquid deployed Elements version 23.3.4 on September 9 to address the affected verification path. According to The Block's later operational update, block production and transactions resumed on September 10, while peg-outs remained disabled as the federation continued recovery and security work.

That sequence separates the network's technical recovery from the effort to recover the remaining assets. Resuming transaction processing indicates that the patched system can operate again, but keeping peg-outs disabled limits movement through the withdrawal mechanism involved in the exploit. The outstanding balance and Blockstream's refusal mean the asset-recovery process remains open even as parts of the service return.

The unresolved balance means the financial outcome can still change if more bitcoin is returned or recovered. For users and institutions, the immediate issues are whether the remaining funds can be traced and frozen, when all withdrawal functions will resume, and what additional technical controls Liquid adopts after the incident. Blockstream has not provided a timetable for recovering the 598.5 BTC.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.

Blockstream refuses ransom for 598.5 BTC after Liquid exploit