Blockstream Refuses to Pay Ransom After Liquid Network Bitcoin Theft
Event summary
Blockstream announced on 11 September that it will not pay a ransom for Bitcoin taken in a Liquid Network exploit. The attack on 6 September created unbacked L‑BTC, which was converted into roughly 4,000 BTC. The actors returned 3,400 BTC, leaving about 598.5 BTC (≈15 % of the total) still missing.
Key numbers
- ≈4,000 BTC released by the exploit
- 3,400 BTC returned to the Liquid peg wallet
- ≈598.5 BTC still outstanding
- Peg‑outs (movement of BTC out of Liquid) remain disabled
Blockstream’s stance
Blockstream called the theft “a crime, not responsible disclosure” and said it will not negotiate with the actors. The company said it will work with law‑enforcement agencies, exchanges, service providers and forensic specialists to trace the assets and identify the perpetrators.
Liquid’s findings
Liquid’s incident report said the exploit targeted how nodes running the open‑source Elements software cached range‑proof verifications. No private keys were compromised. An emergency Elements v23.3.4 update was released on 9 September to fix the vulnerability. Block production and regular transactions resumed on 10 September, but peg‑outs stayed disabled while recovery work continues.
Confirmed facts
- The exploit occurred on 6 September and created about 4,000 L‑BTC not backed by Bitcoin.
- Actors returned 3,400 BTC on 7 September; 598.5 BTC remained outstanding on 8 September.
- Liquid’s network resumed block production on 10 September.
- Peg‑outs are still disabled as a precaution.
- No private keys were compromised in the attack.
Open questions
- The identity of the actors and whether the remaining 598.5 BTC will be recovered are not known.
- Exact timeline for restoring peg‑out functionality has not been announced.
Why it matters
The incident shows how a vulnerability in sidechain software can lead to large, unintended Bitcoin transfers. It also highlights the risk of ransom demands on open‑source developers and the need for rapid security patches.
Next steps
- Liquid will continue recovery work while keeping peg‑outs disabled.
- Blockstream will cooperate with authorities and forensic experts to trace the missing funds.
