Blockstream refuses ransom as Liquid Network hackers still hold nearly 600 BTC
Blockstream said on Sept. 11 it will not pay a ransom for about 598 BTC stolen from the Liquid Network, calling the act theft. The company said in a statement on X that taking assets without authorization and withholding their return is a crime, not responsible disclosure, and that it will pursue the funds through law enforcement and forensic specialists.
The statement answers a demand the self-described white-hat hackers made earlier in the week. According to an onchain message shared by Jan3 CEO Samson Mow on Wednesday, they asked Blockstream to pay a 10% bounty from its own funds and warned that Liquid holders would otherwise face a 15% loss. Blockstream said it had engaged in good faith to secure the return of stolen user funds, but that this should not be mistaken for accepting the hackers’ terms. Paying, it argued, would set a precedent that developers of open-source Bitcoin software can be held for ransoms far beyond their economic participation in the project.
Blockstream warned that if the funds are not returned it will work with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible. “Transactions do not disappear, and neither does the evidence they leave behind,” the company said.
The standoff began on Sept. 6, when hackers withdrew about 4,000 BTC, then worth about $320 million, from Liquid’s federation wallet, forcing the sidechain to pause operations. Blockstream said affected bridge nodes were patched, and the actors returned 3,400 BTC, leaving roughly 598 BTC outstanding. Liquid resumed producing empty blocks on Sept. 10 after emergency software updates, but transfers into and out of the network remain suspended.
Blockstream negotiated with the hackers over the Bitcoin blockchain itself: on Sept. 9 it sent an encrypted message signed with the company’s PGP key to an address controlled by the hackers, a step Mow documented and verified on X.
The identity of the hackers is unknown, and whether the remaining bitcoin will be returned is unresolved.
