Blockstream has rejected a ransom demand linked to the theft of bitcoin from the Liquid Network, saying it will not pay for the return of the funds and calling on those responsible to return the bitcoin. About 600 BTC is described as still outstanding, although the precise amount, the total stolen and the current on-chain balance have not been independently verified.

The company has characterized the unauthorized removal and continued withholding of the assets as a crime rather than responsible disclosure or white-hat activity. Blockstream said any recovery effort would rely on law enforcement, exchanges and forensic specialists instead of ransom negotiations.

Blockstream rejects ransom demand

In a public statement on September 11, 2026, Blockstream said it “will not pay a ransom for the return of stolen funds.” The statement addressed those responsible for taking bitcoin from the Liquid Network and said that taking assets without authorization and withholding their return is a crime, not responsible disclosure. Blockstream also rejected the characterization of the activity as white-hat work.

The full statement was published on X:

To those responsible for the theft of bitcoin from the Liquid Network: Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is… — Blockstream (@Blockstream) September 11, 2026

Source: @Blockstream on X: https://x.com/Blockstream/status/2098281867908690394

According to Decrypt’s report, Blockstream said it would pursue lawful recovery with law enforcement, exchanges and forensic specialists if the funds were not returned. Decrypt also reported that the company ended its message with “Return the bitcoin.” That closing line was not present in the directly retrieved statement excerpt and is therefore attributed to Decrypt’s account.

Two days earlier, on September 9, Blockstream published a security alert acknowledging the Liquid incident and warning users about follow-on phishing attempts. The alert said users did not need to move funds, enter a recovery phrase, check reimbursement, re-peg assets or install software sent by email.

Blockstream also said it would never request a recovery phrase or PIN, or ask users to send funds to any address. The company identified help.blockstream.com as its only support channel. The warnings addressed reimbursement and re-peg lures that can follow a high-profile exploit, when attackers impersonate the affected protocol.

What is known about the remaining bitcoin

The approximately 600 BTC figure refers only to the amount described as still outstanding from the exploit. It should not be interpreted as the total amount stolen, the ransom amount or a confirmed current balance at a bitcoin address. The underlying address balance was not independently verified.

Decrypt’s September 11 report put the outstanding amount at 598.5 BTC, slightly below the rounded 600 BTC figure, and linked the amount to a bitcoin address. The Block separately described the remainder as 600 BTC, based on unconfirmed reports that could not be independently read.

Reported BTC still outstanding: 598.5 BTC

Most of the stolen value has reportedly been returned. Decrypt reported that the attackers returned 3,400 BTC on Monday, September 7, representing roughly 85% of the amount taken.

Reported BTC returned: 3,400 BTC

The same report said approximately 4,000 BTC was drained on Sunday, September 6, with the incident valued at about $320 million. Both the bitcoin amount and the dollar figure were described as approximate. Bitcoin traded near $77,000 during the reporting window, which also included a broader market correction below $77,000. No causal relationship between that market move and the Liquid exploit has been established.

Exploit scope and recovery details remain unverified

Decrypt attributed the exploit to a flaw in the caching of range-proof verifications. According to the report, the flaw allowed unbacked L-BTC to be minted and exchanged for reserve BTC through SideSwap. No technical postmortem was independently retrieved. The reported issue concerns reserve backing at the sidechain accounting layer and does not represent a compromise of Bitcoin’s base protocol.

Unconfirmed reports cited by Decrypt said an on-chain message from the attackers requested 10% of Blockstream’s own funds and threatened a 15% loss for holders. The transaction was not decoded or independently verified, so those claims should not be treated as established facts. When the linked bitcoin address was accessed, it returned only a JavaScript application shell; no live balance or transaction history could be confirmed.

Liquid resumed block production and transaction processing on Thursday, September 10, while peg-outs remained disabled as a precaution, according to Decrypt’s account of the reporting period. The recovery process therefore depends on the legal, investigative and forensic measures identified by Blockstream rather than an automated clawback mechanism.

Blockstream has also faced scrutiny on other fronts. Its chief executive publicly refuted a reported connection to Jeffrey Epstein; that response was covered by AI Crypto Core. The company’s response to the Liquid incident was similarly categorical.

Source article

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always conduct your own research before making decisions.