Blockstream says it will not pay a 10% ransom demanded by the attackers behind the Liquid Network exploit and plans to pursue recovery of the remaining Bitcoin through law enforcement and blockchain forensics.
Bitcoin infrastructure company Blockstream has rejected a ransom demand from the individuals holding cryptocurrency taken during the recent Liquid Network exploit, saying it will not pay a bounty in exchange for the return of the remaining funds.
The attackers initially removed approximately 4,000 BTC from Liquid’s federation wallet. They later returned 3,400 BTC, leaving roughly 598 BTC still under their control.
Blockstream said it engaged with the attackers in an effort to recover affected users’ assets, but rejected the claim that withholding the funds constituted legitimate security research.
“Taking assets without authorization and withholding their return is a crime, not responsible disclosure,” Blockstream said.
The company characterized the activity as theft rather than white-hat security testing.
Hackers Demand 10% Bounty
The attackers reportedly sent an onchain message demanding that Blockstream pay a 10% bounty from its own funds in exchange for returning the remaining Bitcoin.
The demand was shared publicly by Samson Mow, CEO of Jan3 and a former Blockstream chief strategy officer.
According to the message, failure to meet the demand would leave Liquid users facing an effective 15% loss.
Blockstream has rejected that proposal and instead called on the holders of the remaining Bitcoin to return the funds voluntarily.
The company has not indicated that it intends to negotiate a payment to secure the return of the cryptocurrency.
Blockstream Plans Recovery Effort
Blockstream said it is prepared to pursue other methods if the remaining BTC is not returned.
The company said it would coordinate with:
- Law enforcement agencies
- Cryptocurrency exchanges
- Digital asset service providers
- Blockchain forensic specialists
The objective would be to trace the remaining Bitcoin and identify the individuals responsible.
Because Bitcoin transactions are publicly recorded on the blockchain, movements of the stolen funds can potentially be monitored as they travel between addresses. However, tracing funds does not necessarily guarantee that investigators will be able to recover them.
Liquid Exploit Triggered Network Shutdown
The incident began on September 6, when Liquid, a Bitcoin sidechain operated by Blockstream, halted network operations following the unauthorized withdrawal of approximately 4,000 BTC from its federation wallet.
At the time, the cryptocurrency was valued at roughly $320 million.
The scale of the withdrawal prompted Liquid to suspend activity while its operators investigated the incident and worked on emergency security measures.
The attackers subsequently returned 3,400 BTC, reducing the outstanding amount to approximately 598 BTC.
The returned funds represented the majority of the Bitcoin taken during the incident, but a substantial amount remains unresolved.
Liquid Resumes Block Production
Liquid restarted block production on Thursday after implementing emergency software updates.
The network initially produced empty blocks as operators monitored its stability following the exploit.
However, the restart did not immediately restore full functionality.
Transactions and Bitcoin transfers into and out of Liquid remained suspended, meaning users could not yet resume normal movement of assets across the network.
The controlled restart allows the team to assess the effectiveness of the security updates before restoring additional functionality.
Remaining BTC Creates a Difficult Recovery Problem
The approximately 598 BTC still held by the attackers represents the central unresolved issue.
Blockstream has maintained that it intends to protect users affected by the incident while continuing efforts to recover the outstanding funds.
The company’s refusal to pay the requested bounty signals that it views the attackers’ conduct as unauthorized theft rather than a conventional bug-bounty situation.
The attackers, meanwhile, have argued for compensation for returning the remaining assets.
That disagreement leaves the recovery process dependent on voluntary cooperation or the ability of investigators and industry participants to trace and potentially freeze or recover the funds.
Liquid’s Recovery Is Still in Progress
The Liquid incident highlights the challenges involved in securing blockchain systems that rely on federation structures and large pools of digital assets.
Although most of the approximately 4,000 BTC taken in the exploit has reportedly been returned, nearly 600 BTC remains outstanding.
Blockstream’s current strategy is clear: no ransom payment, continued coordination with investigators and industry partners, and an effort to track the remaining Bitcoin.
Meanwhile, Liquid’s return to block production marks only an initial step toward restoring normal operations.
Until transaction and peg functionality are fully reinstated and the outstanding Bitcoin issue is resolved, the network’s recovery remains an ongoing process.
