Blockstream Rejects Ransom Demand for 598.5 BTC Held by Liquid Hackers

Highlights:

• Blockstream says it will not pay the ransom for the remaining 598.5 BTC.
• Liquid hackers returned 3,400 BTC after Blockstream fixed the security flaw.
• Blockstream plans to trace the remaining Bitcoin instead of paying the Liquid hackers.

Blockstream has refused to pay a ransom for roughly 598.5 BTC still held by the actors behind the Liquid Network exploit. Blockstream announced its decision today after several days of negotiations with the unidentified actors over the remaining Bitcoin. The company said the actors took the Bitcoin without permission and later demanded payment to return it.

To those responsible for the theft of bitcoin from the Liquid Network:

Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is…

— Blockstream (@Blockstream) September 11, 2026

Blockstream rejected the actors’ claim that their actions qualified as responsible disclosure or white-hat activity. Blockstream said the actors committed theft by taking the Bitcoin without permission and refusing to return all of it. The statement followed the return of 3,400 BTC to Liquid’s federation wallet on Sept. 7.

The attackers returned about 85% of the Bitcoin that left the federation wallet during the Sept. 6 incident. However, they kept roughly 598.5 BTC under their control after returning the larger amount. The remaining 598.5 BTC was worth nearly $47 million when the attackers returned the 3,400 BTC.

Blockstream said it negotiated with the actors to recover Bitcoin taken from Liquid and protect affected users. However, the company said those talks did not result in the withdrawal or the actors’ later payment conditions. The actors then demanded a 10% bounty from Blockstream for returning the remaining Bitcoin.

Liquid Hackers Challenge Blockstream Security Claims

Nearly 4,000 BTC left Liquid’s federation wallet on Sept. 6 after attackers exploited a vulnerability in the network. Later analysis linked the vulnerability to a cache-key collision within that verification process. Blockstream said the attack did not compromise the federation keys that control Liquid’s reserve. The attackers initially described themselves as white-hat hackers while communicating with Blockstream.

The attackers used messages embedded in Bitcoin transactions to communicate their demands and conditions. They told Blockstream to fix the vulnerability and patch every affected node before they returned most of the stolen Bitcoin. Blockstream later confirmed that its bridge nodes had received the required patches.

The attackers then returned 3,400 BTC to the federation wallet after Blockstream confirmed the patches. However, they kept roughly 598.5 BTC and later demanded a 10% bounty for returning those funds. The Bitcoin Red Team later challenged Blockstream’s account and claimed it had previously reported the vulnerability to the company.

turns out it only costs you 600 BTC to ignore an email from the red team 🟥 https://t.co/6N6si4ajLk

— dr. calle 🟥 (@callebtc) September 10, 2026

Red Team co-lead Calle accused Blockstream of giving an incomplete account of the security disclosure. Blockstream founder Adam Back linked the exploitable code to an earlier bug fix that developers had introduced. Back said developers created the vulnerability while fixing another bug that artificial intelligence had identified.

Liquid halted operations after the exploit and later resumed block production on Sept. 10. The missing 598.5 BTC matters because Liquid needs sufficient Bitcoin reserves to maintain its one-to-one L-BTC backing. In a separate development, the hackers have called Blockstream’s security approach “flagrant neglect of security” and have warned that rejecting the payment could leave Liquid users facing a 15% loss.

Update on @Liquid_BTC discussions:

September 9, 2026

1:31 AM PDT – Blockstream: [encrypted to hacker's key, PGP-signed by [email protected] at 1:31 AM PDT (mined 4:45 AM) – signature verified; medium to long, several paragraphs; sent from a new address… https://t.co/9v4rnxFPXU

— Samson Mow (@Excellion) September 9, 2026

Blockstream Plans to Trace the Remaining Funds

Blockstream said it will pursue the remaining Bitcoin instead of paying the attackers. The company plans to work with law enforcement agencies, exchanges and service providers to trace the funds. Blockstream also expects forensic specialists to help identify the people controlling the remaining Bitcoin.

Bitcoin’s public transaction record allows investigators to track movements from addresses linked to the exploit. Blockstream said the attackers can still return the remaining Bitcoin and follow standard white-hat practices.