TLDR
- Blockstream has refused to pay a ransom for roughly 598.5 BTC still held by hackers following the Liquid Network exploit
- Hackers originally withdrew nearly 4,000 BTC from Liquid’s federation wallet on September 6, 2026
- Around 3,400 BTC was returned after Blockstream patched the vulnerability, leaving about 15% outstanding
- Hackers demanded a 10% bounty from Blockstream’s own funds or threatened Liquid holders with a 15% loss
- Blockstream says it will work with law enforcement, exchanges and forensic specialists to trace and recover the remaining Bitcoin
Blockstream has publicly refused to pay a ransom to the hackers who still hold approximately 598.5 BTC from the Liquid Network exploit. The company called the situation theft and said it will pursue the remaining funds through law enforcement and forensic channels.
To those responsible for the theft of bitcoin from the Liquid Network:
Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is…
— Blockstream (@Blockstream) September 11, 2026
The incident began on September 6, 2026, when actors describing themselves as “whitehats” withdrew nearly 4,000 BTC from Liquid’s federation wallet. At the time, that amount was worth roughly $320 million.
Liquid is a Bitcoin sidechain built and maintained by Blockstream. After the withdrawal, the network paused block production while engineers worked to find and fix the problem.
Blockstream identified the cause as a cache-key collision in confidential transaction verification logic. The company confirmed that federation keys were not compromised.
After Blockstream patched the affected bridge nodes, the actors returned 3,400 BTC to the federation address on September 7. That repayment covered about 85% of the funds taken.
The remaining 598.5 BTC stayed at an address controlled by the actors. When the larger repayment was completed, those coins were worth close to $47 million.
The actors then changed their terms. Through on-chain messages, they demanded that Blockstream pay a 10% bounty from its own funds. If it refused, they warned that Liquid holders would face a 15% loss.
Blockstream Rejects the Demand
Blockstream responded on September 11 by posting a clear rejection on X. The company said it would not pay a ransom for the return of stolen funds and called the actors’ claims of responsible disclosure inaccurate.
“Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft,” the company said.
Blockstream also argued that open-source developers should not be forced to pay large sums after someone exploits code they maintain, particularly when they have no direct economic stake in the network.
The company said it had engaged with the actors in good faith during earlier negotiations but that those talks did not amount to accepting the withdrawal or agreeing to any bounty.
What Happens Next
Blockstream said the actors still have the opportunity to return the Bitcoin voluntarily and follow standard white-hat principles. If they do not, the company plans to involve law enforcement, exchanges, service providers and forensic specialists.
Bitcoin’s public ledger means investigators can continue to track movements from the addresses tied to the incident, even if the coins are split between multiple wallets.
Blockstream pointed to a similar tracing effort following the Coldhead exploit, where Galaxy Research found 1,561 BTC still unmoved after attacker addresses were shared with exchanges and compliance firms.
Liquid resumed block production on Thursday following emergency software updates, though transactions and Bitcoin transfers in and out of the network remained suspended at the time of reporting.
Blockstream told the Bitcoin community it would continue working for users whose funds were taken and thanked engineers, cryptographers and security researchers who helped identify and fix the vulnerabilities.
“Transactions do not disappear, and neither does the evidence they leave behind,” the company said.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
