“Give back the bitcoin,” Blockstream informed the individuals responsible for the Liquid Network hack on Friday, stating it would refuse to pay a reward for the remaining 598.5 BTC.
Blockstream stated that it had attempted to retrieve the capital in good faith but turned down the conditions being requested. “Acquiring funds without permission and keeping them is a crime, not ethical disclosure,” the Adam Back-led Bitcoin infrastructure enterprise stated. “This is not white-hat behavior. It is burglary.”
“We will not comply with establishing the precedent that open-source software built for the benefit of the Bitcoin ecosystem should force its creators to satisfy a ransom far exceeding their financial stake,” Blockstream added, expressing gratitude to the Bitcoin community for its backing.
The organization mentioned the perpetrator still had a chance to rectify the situation and send back the bitcoin (BTC). Nevertheless, if the assets are not restored, it stated it will collaborate with law enforcement, trading platforms, service providers, forensic investigators, and other entities to track and recover the holdings and unmask the culprits.
“Transfers do not vanish, and neither do the traces they leave behind,” Blockstream noted. “We will not purchase stolen property back. We will not desert our users. The Bitcoin community will not cease hunting down the funds.”
Liquid recovery
Liquid’s Sept. 8 incident report explained that the flaw existed in caching range proof validations inside Elements, the foundational software powering the Liquid Network. Roughly 4,000 LBTC was minted without being backed by bitcoin held in reserves.
The hacker subsequently leveraged the Liquid Network wallet and exchange platform SideSwap—which, acting as a Liquid Federation participant, maintains a peg-out authorization key—to trade the unsupported LBTC for real BTC via a standard peg-out. Liquid noted that its network administrators were not breached and no keys were compromised.
On Sept. 7, the hacker sent back approximately 3,400 BTC following a prior onchain communication directing Blockstream to “fix the vulnerability first” before “most” of the coins would be refunded. Still, roughly 598.5 BTC was kept back.
A fresh Elements build, version v23.3.4, went live on Sept. 9. Liquid resumed creating blocks on Sept. 10, and transfers also started working again later that day. However, peg-outs remain turned off as a safety measure, Blockstream stated, “while the final phase of restoration moves forward.”
In a Wednesday OP_RETURN note, the attacker had petitioned Blockstream for a 10% bug reward, asserting the company had spent $1.5 million, “perhaps even 0,” protecting $5 billion in assets. “You MUST disburse 10% out of your own treasury as a reward or else you will trigger all your holders to face a 15% loss due to your negligence and miserliness,” the communication stated.
Originally published at https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247.
