Bitcoin infrastructure firm Blockstream has refused to negotiate further with hackers who last week stole 4,000 bitcoin from its Liquid network.

In a post on X on Friday, Blockstream said the hackers still had an opportunity to return the funds before the company begins working with law enforcement. The post is available at https://x.com/Blockstream/status/2098281867908690394.

The incident began on Sunday, when white-hat hackers withdrew about $320 million from the federation wallet backing Liquid, a sidechain created by Blockstream. Following negotiations with Blockstream, the hackers returned most of the funds but kept 598.5 bitcoin, worth more than $46 million, and demanded that amount as a ransom.

“Blockstream will not pay a ransom for the return of stolen funds,” the company wrote. “Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.”

The complete X post stated:

To those responsible for the theft of bitcoin from the Liquid Network: Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is… — Blockstream (@Blockstream) September 11, 2026

Blockstream added: “We will work with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible.”

“We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds,” the company said.

Liquid, also referred to as L-BTC, is a layer-2 network created by Blockstream that allows users to move assets quickly when they are backed 1:1 by bitcoin. LBTC is a bitcoin-backed token designed to enable rapid settlement, similar in some respects to the Lightning Network.

The hackers obtained the funds by exploiting an inflation bug on the Liquid sidechain. The vulnerability allowed them to create more than 4,000 LBTC that had not previously existed and exchange them for real, on-chain bitcoin.

The hackers then communicated with Blockstream through messages written into Bitcoin blocks. In one message, the white hats wrote: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”

In their latest message, the hackers called Blockstream “delusional, greedy, and arrogant.” They also threatened to disclose all of Blockstream’s encrypted messages from the exchange unless the company allowed them to keep 10% of the bitcoin.

“You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess,” the message read.

The incident follows another major bitcoin theft in July, when hackers stole more than 1,800 bitcoin, worth nearly $140 million, from Coldcard wallet holders. Users of the popular hardware wallet, which was created by Coinkite, were targeted because its manufacturer did not use a true random-number generator. That weakness allowed hackers to essentially guess users’ seed phrases.

This article first appeared in Bitcoin Magazine and was written by Mathew Di Salvo. Original source: https://bitcoinmagazine.com/news/blockstream-tells-demands-bitcoin