Blockstream Won't Pay Ransom After Liquid Network Hack Leaves 598.5 BTC Outstanding

Blockstream says it will not pay a ransom to recover roughly 598.5 BTC that remains unreturned following the Liquid Network incident, according to CoinDesk. The company said attacker-linked addresses moved nearly 4,000 BTC out of the Liquid Federation wallet on September 6, representing most of the reserves at the time. A major withdrawal was recorded that day. On September 7, 3,400 BTC was sent back to the federation address, or about 85% of the amount taken. The remaining 598.5 BTC stayed in addresses controlled by the counterparty and was valued at close to $47 million at the time of the large-scale return. Blockstream said the individuals involved initially presented themselves as "white hats" and communicated via messages embedded in Bitcoin transactions. The company rejected that characterization. In a September 11 post on X, Blockstream said an unauthorized transfer and withholding of assets is theft, not responsible disclosure or white-hat behavior. Blockstream said it engaged with the counterparty out of concern for protecting users and the broader Bitcoin community, but that contact does not constitute acceptance of the withdrawals or any conditions proposed. Based on onchain messages and direct communications, after the vulnerability was patched the counterparty offered to return most of the bitcoin but did not commit to returning all of it. Blockstream said the party later demanded a 10% bounty paid from corporate funds, warning Liquid holders would otherwise face losses. Blockstream said it has explicitly refused. The company said the bug has been fixed and will continue to be monitored. Blockstream attributed the incident to a cache key conflict vulnerability in Liquid's confidential transaction validation logic, adding that federation keys were not compromised. It said relevant bridge nodes have been patched. During the incident, Liquid temporarily halted block production and exchanges were asked to suspend LBTC deposits and withdrawals. Blockstream said the recipient still has the option to return the remaining funds voluntarily. If the bitcoin continues to be withheld, the company said it will work with law enforcement, exchanges, service providers, and onchain forensic firms to trace the assets and identify those responsible. It also noted that Bitcoin transactions leave a public trail on the blockchain and can be tracked even if the funds are later split across multiple wallets. Blockstream reiterated it will not pay any ransom and will continue pursuing recovery of the remaining bitcoin.