Blockstream Refuses Ransom Demand After Liquid Network Exploit, Keeps Remaining 598.5 BTC
Blockstream rejects ransom demand
Blockstream, the company that runs the Liquid Network, announced on Friday that it will not pay a bounty to the hacker who kept roughly 598.5 BTC after the September exploit. The firm called the demand for a 10 % bug bounty “theft” and said it would involve law enforcement to trace the missing coins.
Key points
- Blockstream will not pay the 10 % bounty demanded by the exploiter.
- About 598.5 BTC remains unrecovered after the attacker returned 3,400 BTC.
- Liquid network transactions have resumed, but peg‑outs (moving coins back to Bitcoin) stay disabled.
- Blockstream plans to work with exchanges, forensic specialists and authorities to recover the assets.
Official statement
Blockstream said the attacker “took assets without authorization and withheld their return, which is a crime, not responsible disclosure.” The company added it will not set a precedent that open‑source developers must pay ransom that exceeds their economic participation.
Confirmed facts
- The vulnerability was in the caching of range‑proof verifications in Elements, the software that powers Liquid.
- On September 7 the attacker returned roughly 3,400 BTC after an on‑chain message asking Blockstream to fix the bug first.
- About 598.5 BTC was not returned.
- A new Elements version (v23.3.4) was deployed on September 9; Liquid resumed block production on September 10 and transactions later the same day.
- Peg‑outs remain disabled as a precaution while recovery continues.
Unresolved issues
The 598.5 BTC is still missing, and the attacker has not complied with Blockstream’s request to return it. No keys were compromised, but the exact method used to create unbacked LBTC (Liquid‑backed Bitcoin) is still under investigation.
Why it matters
Liquid is a sidechain that lets users move Bitcoin in and out quickly. The exploit created about 4,000 LBTC without proper Bitcoin backing, which could affect confidence in the sidechain’s peg mechanism. Keeping peg‑outs disabled protects users while the network works to secure its reserve.
Next steps
Blockstream said it will cooperate with law‑enforcement agencies, exchanges, service providers and forensic experts to trace the stolen coins and identify the attacker. The company also thanked the broader Bitcoin community for its support.
