Blockstream says it will not pay a ransom to recover roughly 598 BTC still held by the hackers who drained the Liquid Network, calling their actions theft rather than white-hat work and pledging to chase the funds with law enforcement and forensic specialists. The company said in a statement on X that taking assets without authorization and withholding their return “is a crime, not responsible disclosure.”
The standoff began Sept. 6, when self-described white-hat hackers withdrew about 4,000 BTC, then worth about $320 million, from the Liquid sidechain’s federation wallet. After Blockstream patched the affected bridge nodes, the actors returned 3,400 BTC and, in an onchain message shared by Jan3 CEO Samson Mow, demanded a 10% bounty from Blockstream’s own funds, warning that Liquid holders would otherwise face a 15% loss.
Blockstream rejected the demand outright. It said it had engaged in good faith to secure the return of stolen user funds, but that the effort should not be mistaken for accepting the hackers’ terms. The company also argued that paying would set a precedent in which open-source software built for the Bitcoin community exposes its developers to ransoms far beyond their economic participation, adding that Bitcoin “doesn’t haircut users to pay a ransom.”
Its warning to the hackers was direct: “We will not pay for the return of stolen property. We will not abandon our users.” If the funds are not returned, Blockstream said it will pursue every lawful avenue available, working with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible. It pointed to the ledger itself, noting that transactions do not disappear and neither does the evidence they leave behind.
Liquid has resumed producing empty blocks after emergency software updates, but transactions and Bitcoin transfers into and out of the network remain suspended. The identity of the actors and the fate of the remaining bitcoin are still unresolved.
