Blockstream Rejects Ransom-Style "Bounty" Demand as Liquid Exploit Leaves ~598 BTC Outstanding

Blockstream says it will not negotiate with the group it holds responsible for the recent Liquid Network disruption, arguing that the request for a so-called bounty is effectively extortion and should not be framed as "responsible disclosure." In a statement posted Friday, the Bitcoin infrastructure firm said it initially engaged in good faith to help recover user funds, but it will not meet conditions tied to the return of remaining Bitcoin still unaccounted for after the incident. Key points - Blockstream rejects the demanded "bounty" payment and says the outstanding funds should be returned unconditionally. - If the Bitcoin is not returned voluntarily, Blockstream says it will escalate efforts with law enforcement, exchanges, service providers, and forensic specialists. How the Liquid incident unfolded Liquid is a Bitcoin sidechain operated under a federation model. The disruption began when self-described "whitehat" actors withdrew roughly 4,000 BTC from Liquid's federation wallet, an amount reported at the time to be worth about $320 million. Liquid then paused operations while bridge-related components and procedures were addressed. Blockstream later said affected bridge nodes were patched. Following those fixes, about 3,400 BTC was returned, leaving approximately 598 BTC still outstanding. Blockstream draws a firm line on payment demands Blockstream says it will not pay to recover assets it considers to have been taken without authorization. The company called the conduct "theft" and said it does not qualify as whitehat activity. According to reporting referenced in the statement, the attackers communicated via an onchain message requesting Blockstream pay a bounty equal to 10% of the requested amount from its own funds, while threatening Liquid holders with a 15% loss if Blockstream did not comply. Jan3 CEO and former Blockstream chief strategy officer Samson Mow publicly shared the onchain appeal. Blockstream urged the holders of the remaining Bitcoin to return it without further conditions. If that does not happen, the firm said it will pursue tracing and identification, coordinating with exchanges and service providers alongside law enforcement and forensic teams. Network status: blocks are back, transfers still paused Blockstream said Liquid has resumed block production after emergency software updates, though the network was producing empty blocks, indicating transaction activity had not fully restarted. At the time of the report, transactions and Bitcoin transfers into and out of Liquid remained suspended. The distinction matters for users: a network can resume producing blocks while still restricting deposits, withdrawals, and other asset-movement pathways that depend on bridge components and additional safeguards. Why the refusal to pay changes the calculus By refusing the demanded bounty, Blockstream is signaling it does not want to set a precedent that turns unauthorized fund removal into a monetizable "disclosure" playbook. The stance also shifts the likely path to resolution away from negotiation and toward forensic tracking and third-party coordination that could help identify or constrain fund flows. For Liquid users, the central question remains whether the roughly 598 BTC still tied to the incident will be returned without conditions, and when transfers into and out of the network will be re-enabled.