Blockstream rejects ransom as Liquid hackers hold nearly 600 BTC

Blockstream has rejected a ransom demand from the hackers who still control nearly 600 Bitcoin taken from the Liquid Network, declaring that withholding user assets is theft rather than responsible disclosure. The Bitcoin infrastructure company said it engaged in good faith but will not meet the attackers’ terms. The standoff matters because it tests how federated Bitcoin sidechains handle catastrophic breaches and whether victims can recover funds without rewarding criminals.

The incident began on Sept. 6, when Liquid, a Bitcoin sidechain, paused operations after self-described white-hat hackers withdrew about 4,000 BTC—then worth roughly $320 million—from its federation wallet. The network’s peg depends on a federation of functionaries, making the wallet a high-value target. The attackers later returned 3,400 BTC after Blockstream said affected bridge nodes had been patched, leaving about 598 BTC outstanding.

The hackers demanded that Blockstream pay a 10% bounty from its own funds, according to an onchain message shared by Jan3 CEO and former Blockstream chief strategy officer Samson Mow. They warned that Liquid holders would otherwise face a 15% loss. Blockstream publicly urged the hackers to return the remaining Bitcoin voluntarily, framing the demand as extortion rather than a legitimate bug bounty. At BTC near $77,600, the outstanding 598 BTC is worth roughly $46 million.

Technically, Liquid resumed block production on Thursday, but only empty blocks were produced following emergency software updates. Transactions and Bitcoin transfers into and out of the network remained suspended. The federated bridge model requires multiple trusted signers; once compromised, it can move large amounts of BTC. Patching bridge nodes addressed the flaw but did not recover the outstanding coins.

In the short term, Liquid users face frozen transfers, reduced liquidity and damaged confidence. In the long term, the episode could accelerate scrutiny of federated sidechains and encourage exchanges to blacklist tainted coins. Paying a ransom would set a dangerous precedent, while refusing could leave victims uncompensated. Law enforcement tracing may also chill future attackers if identified.

Blockstream’s response was unequivocal. "Taking assets without authorization and withholding their return is a crime, not responsible disclosure," the company said Friday. "It is not white-hat activity. It is theft." Mow’s sharing of the onchain message amplified the debate, splitting community opinion between those who view the initial withdrawal as a white-hat warning and those who call it outright theft.

Looking ahead, Blockstream said it will work with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible if the hackers do not return the Bitcoin. Liquid is expected to restore full functionality only after further audits and upgrades. The remaining 598 BTC, worth tens of millions, remains the focal point of a tense crypto standoff.

Turn any website into clean JSON.

Ready-made scrapers & AI agents

Try Apify