Blockstream has rejected a bounty demand from an attacker who took bitcoin from the Liquid Network, despite the reported return of 3,400 BTC. The company said the unauthorized taking and withholding of assets constituted a crime rather than a good-faith security disclosure or “white-hat” activity.

Blockstream, the company behind Liquid, describes the network as a Bitcoin-linked “sidechain” designed to support faster and more private transfers. The incident involved funds being drained from the network before a demand was reportedly made for payment in exchange for returning them.

Blockstream says it will not pay

On September 11, 2026, Blockstream said in a statement posted on X that it would not pay the demanded bounty. The company’s post stated:

To those responsible for the theft of bitcoin from the Liquid Network: Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is… — Blockstream (@Blockstream) September 11, 2026

The statement is available from @Blockstream on X. Blockstream characterized the demand as a ransom request and said it would work with law enforcement, exchanges, and forensic specialists. No criminal charges or specific law-enforcement agency have been publicly identified.

The company’s refusal followed the reported return of most of the bitcoin involved. A September 11 report by crypto.news said that 3,400 BTC was returned to a Liquid federation wallet on September 7, 2026.

Reported movements and outstanding balance

The returned bitcoin did not account for all of the funds reported to have left the wallet. crypto.news said nearly 4,000 BTC was withdrawn from the federation wallet on September 6, 2026. That figure is a reported approximation rather than the result of a transaction-by-transaction audit.

Both crypto.news and Unchained put the outstanding amount at approximately 598.5 BTC. The frequently cited “600 BTC” figure is therefore rounded and should not be treated as an exact observed balance.

The distinction between the reported return and the outstanding balance is operationally significant: the available reports describe a partial recovery, not confirmation that all affected bitcoin has been restored. A complete accounting still depends on verified transaction records and further information about the remaining funds.

The available timeline establishes that the 3,400 BTC return preceded Blockstream’s public rejection of the demand. It does not establish precisely when the bounty demand was made or who controlled the wallet that received or returned the funds.

Unchained attributed an account of the movement to SideSwap, a Liquid trading service. According to that account, 4,000 L-BTC reached SideSwap’s peg-out service at 14:05 UTC, followed by the payment of approximately 4,000 BTC 23 minutes later. SideSwap reportedly said that its systems and its Peg-out Authorization Key had not been compromised.

Details of the demand remain unconfirmed

The dispute also concerns how the person or group behind the transaction should be described. A demand for payment after taking funds is different from participation in an official bug-bounty program, under which a company invites researchers to report vulnerabilities and agrees in advance on potential compensation. No public agreement authorizing the attacker to retain the coins has been disclosed.

The precise demand has only been partly documented. crypto.news reported that on-chain messages sought a 10% bounty funded by Blockstream. However, the original messages and the exact denominator used for the calculation were not independently verified.

Some reports have referred to a $50 million demand. That figure originated in a blocked report and, based on the unconfirmed reporting cited in the source material, cannot be treated as an established amount.

Industry figures have also questioned the description of the incident as white-hat activity. Unchained reported that Ledger Chief Technology Officer Charles Guillemet challenged that characterization and said a negotiated reward involving retained coins appeared more like extortion. This is a paraphrase attributed to Guillemet, not a direct quotation.

Blockstream issues phishing warning

Blockstream separately warned users about potential impersonation scams following the incident. In its September 9 security notice, the company said that impersonators were posing as Liquid, Blockstream, and support personnel.

Blockstream said the incident did not require users to move funds, enter a recovery phrase, check a reimbursement, re-peg assets, or install software sent by email. Messages asking users to take those actions are likely to be scams rather than legitimate communications from the company.

Users should ignore unsolicited requests and verify information through official channels. Similar impersonation attempts have appeared during other security incidents, including the fake official requests reported in connection with Revolut.

Several important details remain unresolved, including the precise reward demanded, the full basis for Blockstream’s refusal, and the final disposition of the outstanding coins. The next verifiable developments would be confirmation of the reported wallet movements, clarification of the demand terms, and any publicly identified law-enforcement or forensic findings. The company continues to describe the taking and withholding of the assets as a crime, while the reported wallet movements, demand terms, and attribution remain subject to verification.

For broader market context, Bitcoin traded near $77,139 at the time of writing and was little changed on the day, according to CoinGecko. That price reflects prevailing market conditions and should not be interpreted as a reaction to the Liquid incident.

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always conduct independent research before making decisions.