Blockstream said it will not pay a ransom for the return of approximately 598.5 BTC, worth about $47 million, that remains missing after the Liquid Network exploit. The decision ends days of negotiations with the individuals who took the funds.

The attackers drained around 4,000 BTC from the Liquid sidechain on Sunday, with the assets valued at approximately $320 million at the time. They returned 3,400 BTC on Monday, or about 85% of the stolen amount. The remaining 598.5 BTC is still held at the address to which it was withdrawn and has not moved.

“Taking assets without authorization and withholding their return is a crime, not responsible disclosure,” Blockstream said on Friday. “It is not white-hat activity. It is theft.”

In a post on X, Blockstream addressed those responsible for the theft:

To those responsible for the theft of bitcoin from the Liquid Network: Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is… — Blockstream (@Blockstream) September 11, 2026

https://x.com/Blockstream/status/2098281867908690394?ref_src=twsrc%5Etfw

The exploit involved a flaw in the way Liquid nodes cached range-proof verifications. The vulnerability enabled the attackers to mint unbacked L-BTC and exchange it for reserve Bitcoin through SideSwap, a federation member that held a peg-out authorization key. Liquid’s reserve subsequently fell to 197 BTC.

Blockstream patched the bridge nodes within 10 hours and released Elements v23.3.4 on Wednesday. Liquid resumed producing blocks and processing transactions on Thursday, although peg-outs remain disabled as a precaution while “the final stage of recovery” continues. Peg-outs are the mechanism for exchanging L-BTC for bitcoin held in Liquid’s reserve, so keeping them disabled prevents that conversion while recovery work continues. The company also warned that scammers were targeting node operators with fake update websites.

Liquid’s incident report on Tuesday described the attackers as a “white hat hacker” and said the project was coordinating with the individual to restart the network. Blockstream said its participation in those discussions “should not be mistaken for acceptance of the actions taken nor of the terms being demanded.”

The demands were made public in a Bitcoin transaction on Wednesday. The exploiters claimed Blockstream had allocated “only $1.5M (maybe even 0) to secure $5B assets,” describing that as “a flagrant neglect of security.” They demanded 10% “using your own money as bug bounty,” or warned that “you will cause all your holders a 15% loss for your irresponsibility and stinginess.”

Blockstream says it will not set a ransom precedent

Blockstream said it would not be “a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation.”

The company also said it would not cover the shortfall using users’ funds. “Bitcoin is hard money and can't be minted without costs,” it said. “Bitcoin doesn't haircut users to pay a ransom.”

If the remaining bitcoin is not returned, Blockstream said it will pursue “every lawful avenue” with law enforcement, exchanges and forensic specialists. “Transactions do not disappear, and neither does the evidence they leave behind,” the company said, concluding: “Return the bitcoin.”

Source: Decrypt