Blockstream rejects ransom demand after Liquid hack

TLDR

Blockstream has refused to pay a ransom or bounty to recover Bitcoin still missing after the recent Liquid Network exploit.

1. Attackers exploited a software bug on 6 Sep to mint unbacked L-BTC and swap it for about 4,000 BTC, later returning roughly 3,400 BTC.
2. The group demanded a 10% bounty from Blockstream for the remaining ~598.5 BTC, but Blockstream publicly called the demand theft and said it will not pay.
3. Liquid has resumed transactions with peg-outs disabled, and Blockstream plans to work with law enforcement and exchanges to trace the remaining BTC, raising questions about sidechain security and bug-bounty norms.

Deep Dive

1. What Happened In The Liquid Exploit

Liquid Network is a federated Bitcoin sidechain operated with a shared reserve of BTC. On 6 Sep, attackers abused a vulnerability in the Elements codebase that powers Liquid, allowing them to mint around 4,000 unbacked L-BTC and swap it for real BTC from the federation wallet, draining reserves to about 197 BTC.

Liquid and Blockstream say no signing keys were compromised; the flaw was in cached range-proof verification logic that let invalid peg-outs be treated as legitimate. The actors later returned roughly 3,400 BTC, leaving about 598.5 BTC, worth around $47 million, still outstanding according to reports from outlets like Crypto.news.

Blockstream patched bridge nodes within hours and shipped an emergency Elements release to close the vulnerability, enabling Liquid to resume block production.

2. Blockstreams Stance On The Ransom Demand

After the partial return, the actors sent on-chain messages identifying themselves as white-hats and demanding a 10% bounty from Blockstreams own funds in exchange for returning the rest, warning Liquid users could face a 15% haircut.

Blockstream rejected the demand in a statement quoted by Cointelegraph, saying, Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft. The company argued that paying would set a precedent where open-source developers are expected to fund ransoms far beyond their economic stake, and reiterated that Bitcoin doesnt haircut users to pay a ransom, as summarized by CryptoPotato.

Blockstream instead urges the actors to return the BTC voluntarily and frames the episode as extortion rather than bug bounty.

3. Impact On Users And What To Watch

For Liquid users, recovery is incomplete. The network has resumed transactions, but peg-outs (moving BTC out of Liquid) remain disabled while the system is stabilized and the remaining shortfall is addressed, as noted by The Defiant. L-BTC is only partially backed until the missing BTC is recovered or losses are formally allocated.

Blockstream says it will work with law enforcement, exchanges, service providers, and forensic specialists to trace the remaining coins. Bitcoins public ledger gives strong visibility into where funds move, but converting that into legal recovery can be slow and uncertain. The incident also raises broader doubts about federated sidechains and drain then negotiate disclosure tactics, which may face more resistance from major infrastructure providers after this case.

Conclusion

Blockstreams refusal to pay a ransom after the Liquid exploit turns the remaining 598.5 BTC into a test case for how far the industry will go in tolerating white-hat narratives built on real user losses.

The technical bug is largely fixed, but trust in Liquids model and similar sidechains depends on how transparently losses are handled and whether remaining funds are recovered through legal and forensic channels instead of payouts to attackers.