Blockstream has refused to pay a ransom demanded by the actors behind the Liquid Network exploit, escalating efforts to recover approximately 598.5 BTC that remain outstanding. The company said it will pursue legal, exchange and blockchain-forensics channels rather than compensate the attackers for returning assets taken without authorization.
In an official September 11 statement, Blockstream rejected the actors’ characterization of the incident as responsible disclosure and described the withholding of Bitcoin as theft. The response follows the withdrawal of nearly 4,000 BTC, worth about $320 million at the time, from Liquid’s federation reserves on September 6.
To those responsible for the theft of bitcoin from the Liquid Network:
Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is…
— Blockstream (@Blockstream) September 11, 2026
Blockstream Rejects 10% Bounty Demand
The actors had identified themselves as white-hat researchers and returned 3,400 BTC after Blockstream patched the underlying vulnerability. Roughly 85% of the withdrawn Bitcoin was recovered, leaving about 598.5 BTC, recently valued near $47 million, under the attackers’ control.
On-chain messages later demanded that Blockstream fund a 10% bounty from its own resources. Blockstream rejected those terms and argued that paying would establish an unacceptable precedent in which open-source developers could be forced to fund large retroactive bounties after unauthorized asset seizures.
The underlying exploit involved a vulnerability in Elements, the open-source software supporting Liquid. The flaw allowed unbacked L-BTC to be created and subsequently used in a valid-looking peg-out process. The incident did not involve compromised Bitcoin private keys or a failure of Bitcoin’s base-layer consensus, instead exposing a software vulnerability specific to Liquid’s federated sidechain infrastructure.
Liquid Recovery Continues After Partial Restart
Liquid moved into a controlled recovery phase after releasing Elements v23.3.4 and updating functionary and bridge nodes. Block production resumed on September 10 while peg operations remained suspended, allowing operators to monitor network stability before restoring the mechanisms that move BTC between Bitcoin and Liquid.
The unresolved Bitcoin remains a central issue because Liquid ordinarily maintains a 1:1 relationship between circulating L-BTC and BTC held by the federation. Blockstream CEO Adam Back has said the L-BTC peg will be covered, reducing the immediate prospect that holders will be forced to absorb the reserve gap created by the exploit.
Blockstream said it plans to work with law enforcement, exchanges, service providers and forensic specialists to trace the remaining funds and identify those responsible. Bitcoin’s transparent transaction history gives investigators a persistent trail even if the outstanding coins begin moving, although successful tracing does not guarantee recovery.
For Liquid users and institutional counterparties, the immediate concern remains operational rather than a threat to Bitcoin itself. The key milestones are recovering or replacing the remaining 598.5 BTC and safely restoring full peg functionality, which will determine when Liquid can return to normal settlement conditions after the largest security incident in its history.
