Blockstream said it will not pay a ransom for the approximately 600 BTC still missing after the Liquid Network exploit, taking a firm position in one of 2026’s most closely watched cryptocurrency security incidents.

The refusal was reported on September 11, 2026. According to crypto.news, Blockstream said it would not meet a demand connected to the stolen Bitcoin. Liquid is a Bitcoin sidechain, meaning it is a separate blockchain linked to the main Bitcoin network.

Blockstream rejects reported ransom demand

Blockstream, the company behind the Liquid Network, said it would not pay to recover the missing Bitcoin. The statement was also reported by Unchained.

Unchained reported that the attackers demanded a fee equal to 10% of the 4,000 BTC taken during the incident. Blockstream rejected the demand and also disputed any “white-hat” characterization, a term sometimes used when an attacker returns stolen funds in exchange for a reward.

The phrase “Return the bitcoin” has been attributed to Blockstream through reporting that quotes the company’s post. Unconfirmed reports say the exact wording appeared in Blockstream’s original statement on X, although that post was not independently verified in the available evidence.

Blockstream said it plans to work with law enforcement, exchanges, service providers and forensic specialists if the funds are not returned. No named agency, case number or court filing has been confirmed.

Approximately 598.5 BTC remains outstanding

The commonly cited figure of roughly 600 BTC refers to the portion of the stolen funds that remains outstanding after some Bitcoin was returned. Reporting places the outstanding amount at approximately 598.5 BTC, making 600 BTC a rounded figure rather than an exact wallet balance.

Crypto.news reported that 3,400 BTC was returned to the Liquid federation wallet on September 7, 2026. The federation is the group of businesses that jointly manages the network.

The incident began with a software flaw. SideSwap, a Liquid-based exchange, said a consensus bug in Elements, the software behind Liquid, allowed someone to create unbacked L-BTC on September 6, 2026. L-BTC is Liquid’s version of Bitcoin and is intended to be backed one-to-one by real BTC.

The unbacked L-BTC was then exchanged for Bitcoin. SideSwap identified an unbalanced mint transaction at Liquid block 4,050,336 at 13:53 UTC. It said federation signers released 3,996.02 BTC approximately half an hour later, and that its service forwarded nearly all of those funds—3,995.99999857 BTC—to the attacker in the same block.

Nearly 4,000 BTC therefore left the system in a single transaction sequence. Earlier coverage by CoinLineup described the initial Liquid federation Bitcoin withdrawal when the incident first emerged: Liquid federation BTC withdrawal reported as security incident.

SideSwap details operational weaknesses

SideSwap acknowledged that its payout design had failed. The exchange said its authorization key was online, payouts were automated, and its processing pipeline lacked checks for order size, rate, velocity, supply and wallet age.

SideSwap also identified 70 balanced rehearsal transactions before the single unbalanced mint. However, it cautioned that the earlier wallets could not all be linked to the attacker.

For general market context, Bitcoin traded near $77,277 during the research window, down approximately 0.8% on the day, according to CoinGecko. That price information is general market context and does not establish that the exploit caused the move.

Recovery and operational status remain unclear

Rejecting a ransom does not mean that the missing Bitcoin has been recovered. The available evidence confirms Blockstream’s refusal but does not show independently verified recovery of the outstanding coins. No deadline or official recovery plan has been published.

The most material updates to watch are independently verifiable movements of the outstanding Bitcoin, a confirmed recovery announcement, and changes to Liquid’s peg and redemption status. Until such information is published, the returned 3,400 BTC and the approximately 598.5 BTC still outstanding should be treated as separate figures.

The incident also disrupted Liquid operations. Unchained reported that peg operations—the process for moving Bitcoin into and out of Liquid—were suspended at the time of its reporting. SideSwap later said its markets had reopened while L-BTC redemptions remained paused, meaning the operational status could change quickly. CoinLineup reported the update here: SideSwap markets reopen while L-BTC redemptions remain suspended.

Users also faced the risk of scams. Blockstream warned on September 9 that impersonators were exploiting the incident. The company said it would never ask users to move funds, enter recovery phrases, re-peg assets or install software sent by email.

People holding Bitcoin on an exchange or in a personal wallet are not directly affected by the Liquid exploit based on the information available. Users should rely on official channels for updates and treat any message requesting a recovery phrase as a scam, regardless of the identity it claims to represent.

The incident has also been compared with how token custody affected the outcome of the NES recovery after its exploit: NES recovery after exploit and token custody.