Blockstream has reportedly refused a ransom demand linked to a Liquid Network exploit involving a remaining 600 BTC. However, the refusal itself has not been independently confirmed. The company’s only verified public communication currently available is a phishing warning, while the ransom terms, recovery status, and mechanics of the alleged exploit remain unproven.

What has been reported

A widely circulated headline states that Blockstream rejected a ransom demand connected to the Liquid Network exploit and includes the phrase “Return the bitcoin.” According to unconfirmed reports, the wording came from Blockstream. No original statement, named speaker, or publication date has been verified, however, so the phrase should be treated as headline language rather than a confirmed quotation.

The headline also refers to 600 BTC as the amount remaining from the exploit. It does not establish that 600 BTC was the ransom amount, and the available material provides no incident accounting showing the original loss, previous recoveries, the assets’ custody, or the size of any demand.

Blockstream’s verified communication

Blockstream’s verified public communication is a security notice dated September 9, 2026, titled a phishing alert. In the notice, the company acknowledged a recent Liquid Network incident and identified itself as Liquid’s technical provider. The alert says users do not need to move funds, enter a recovery phrase, check a reimbursement, re-peg assets, or install software sent by email.

Blockstream also warned that impersonators were posing as Liquid, Blockstream, and support staff through emails, copied websites, and direct messages. The company said it will never ask users for a recovery phrase or PIN, and will not ask them to send funds anywhere. The notice is available on Blockstream’s official blog.

The security warning acknowledges an incident but does not explain how it occurred. It also does not establish whether the Liquid protocol itself, rather than a related component, was compromised. The affected assets and users likewise remain unverified in the available evidence.

What the 600 BTC figure means

The use of the word “remaining” does not show how much bitcoin was originally taken or whether any funds were returned. No incident-linked transaction hashes, wallet addresses, or blockchain explorer entries have been identified in the available material to support the 600 BTC figure. It should therefore not be treated as an on-chain-confirmed balance.

A dollar conversion would also require a sourced price at the time of the relevant transfer. A general reference to Bitcoin trading at its current level, or at levels above those seen during earlier market cycles, would not establish a connection to this incident and does not provide a basis for valuing the alleged loss or ransom.

The available information also does not show whether the reported 600 BTC remains under the control of any particular party, whether recovery efforts have taken place, or whether a ransom was formally demanded. The headline’s reference to a refusal does not by itself resolve any of those questions.

Liquid service status and recovery questions

A reported demand to return funds is not evidence that the funds were recovered. The available headline provides no confirmed recovery outcome, and there are no supporting statements, transaction records, or investigation updates establishing that any bitcoin was returned.

Liquid’s own public notice provides the clearest verified operational detail. The official Liquid website states that transfers of issued assets have resumed, while LBTC (Liquid Bitcoin) transfers and peg-out operations remain paused. This indicates partial restoration of services, but it does not confirm the recovery of any disputed funds.

Any claim that bitcoin has been returned would require a direct statement supported by transaction evidence. Similarly, claims about continuing negotiations would require sourced statements. Neither is available in the material reviewed here. Further clarity would depend on a verified incident account, identifiable on-chain records, or subsequent official updates on Liquid’s paused services and any recovery effort.

The disruption follows an earlier report that the Liquid Network paused after a large bitcoin withdrawal, but that report does not independently establish the exploit’s mechanics, the scale of any loss, or the status of the alleged ransom. Although infrastructure incidents have coincided with broader market movements in the past, no incident-specific market reaction has been verified in this case.

For now, the reported ransom refusal, the 600 BTC figure, and the recovery status remain unconfirmed. This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk.