Blockstream rejects ransom after 4,000 BTC hack

TLDR

Blockstream has refused to pay a ransom to recover nearly 600 BTC still missing after a roughly 4,000 BTC exploit on its Liquid Network sidechain.

1. Attackers exploited a software bug to mint unbacked L-BTC, drained about 4,000 BTC, then returned roughly 3,400 BTC while keeping around 598.5 BTC and demanding a 10% bounty.
2. Blockstream calls this theft, not white-hat hacking, and says it will not pay a ransom, arguing that doing so would set a harmful precedent for open source Bitcoin software.
3. Liquid has patched the bug and resumed block production, but peg-outs are still paused and L-BTC remains only about 85% backed while the remaining BTC is unrecovered, so users should treat bridge risk carefully.

Deep Dive

1. What Happened In The 4,000 BTC Exploit

On 6 Sep, attackers hit Blockstreams Liquid Network, a federated Bitcoin sidechain, by abusing a vulnerability in the Elements code that underpins Liquid.

The bug in cached range-proof verification let them create unbacked L-BTC and swap it out through standard peg-out infrastructure for almost 4,000 real BTC from the federation wallet, draining roughly 95% of reserves at the time. Importantly, reports say the federations signing keys were not compromised, it was a logic flaw rather than a key theft exploit, as detailed in coverage of the Liquid Network exploit.

After Blockstream patched nodes and shipped Elements v23.3.4, the attackers returned about 3,400 BTC, leaving roughly 598.5 BTC (about 15% of the total) still under their control.

2. Why Blockstream Rejected The Ransom

The attackers positioned themselves as white-hats, then demanded a 10% bounty from Blockstreams own funds and warned that Liquid holders could suffer a 15% loss if the company refused.

Blockstream publicly responded that taking assets without authorization and withholding their return is a crime, not responsible disclosure, and stated clearly that it will not pay a ransom for the return of stolen funds. It argues that paying would normalize a playbook where attackers drain funds first and negotiate later.

The company also stresses that open source developers should not be forced to pay ransoms larger than their own economic stake in a project and that Bitcoin does not haircut users to pay a ransom, a stance echoed in multiple reports on the rejected 10% bounty.

3. Impact On Liquid Users And What To Watch

Liquid has resumed block production and transactions after emergency patches, but peg-outs from L-BTC back to BTC remain disabled during recovery, and L-BTC is only roughly 85% backed while the missing 598.5 BTC is unrecovered, as noted in updates on Liquids recovery phase.

Blockstream says it will work with law enforcement, exchanges, service providers and blockchain forensic firms to trace the remaining coins and identify those responsible, leaning on Bitcoins transparent transaction history.

For users, the key risks are temporary illiquidity and backing shortfall of L-BTC until either the remaining BTC is returned or a formal resolution plan is announced around who ultimately eats the loss.

Conclusion

Blockstreams refusal to pay ransom after recovering most of the stolen BTC draws a clear line between coordinated disclosure and post-exploit extortion.

The Liquid exploit underscores that even without key compromise, bugs in bridge or sidechain logic can threaten reserves, and how projects respond can shape industry norms.

Going forward, the main factors to watch are whether the remaining BTC moves through traceable venues, when peg-outs safely reopen, and how other projects handle similar white-hat ransom demands.