Blockstream Refuses to Pay Ransom as Liquid Network Hackers Hold $47 Million in Bitcoin

Blockstream Draws Line Against Ransom Demands

Blockstream has made a firm decision not to pay a ransom for the return of nearly 600 Bitcoin, valued at about $47 million, that remains in the hands of hackers following the recent Liquid Network exp

The attackers embedded their demands directly onchain, criticizing Blockstream’s security investments and laying out terms for the return of funds. In response, Blockstream stated unequivocally that it will not cover user losses or negotiate with those responsible for what it described as theft. The company instead committed to working with law enforcement agencies, exchanges, service providers, and forensic specialists to trace the assets and identify those behind the attack if restitution is not made.

Liquid Network Hackers Hold Out for Bounty

The hackers’ tactics have introduced a rare public standoff between protocol operators and exploiters. After draining about 95% of the federation wallet’s balance—roughly 4,000 out of 4,200 BTC—the attackers returned 3,400 BTC (about $270 million) once Blockstream patched affected bridge nodes. Yet they retained control over approximately 598 BTC (worth around $46–$47 million), which remains unmoved at the address used during the hack.

On September 6, Liquid paused operations after the attackers withdrew nearly 4,000 BTC from its federation wallet.

Their message was clear: pay us a bounty or risk further user losses.

This partial return is notable for its scale but also for its ambiguity; while the actors claimed white-hat intentions in their communications, Blockstream has firmly rejected any suggestion that this was an ethical security disclosure. The tension between the hackers' self-described motives and Blockstream’s refusal to negotiate underscores a broader debate in crypto security over what constitutes responsible disclosure versus extortion.

Empty Blocks Signal Ongoing Liquid Disruption

Following emergency software updates and patching efforts that concluded within ten hours of discovery, Liquid Network resumed block production on Thursday—but with a significant caveat. For now, blocks are being produced without processing transactions as a precaution while monitoring continues. According to cointelegraph.com, peg operations—including PAK-authorized peg-outs that allow users to move Bitcoin into or out of Liquid—remain suspended as recovery efforts are underway and reserves are restored.

While block production has technically resumed, transactions and Bitcoin transfers both into and out of Liquid remain frozen. This means normal network activity is still on hold despite visible progress in infrastructure recovery. The contrast is stark: technical operations are moving forward, yet user functionality remains largely paralyzed.

Law Enforcement Pursuit Looms Over Stolen BTC

With nearly 600 BTC still missing and no sign of movement from the hackers’ address since Monday’s partial return, Blockstream has shifted focus toward legal avenues. The company stated it will collaborate with law enforcement agencies globally as well as major exchanges and forensic blockchain specialists to track down both the stolen coins and those responsible for their theft. It’s uncertain how effective these efforts will be given Bitcoin’s pseudonymous nature and history of coin-mixing services complicating asset tracing.

Blockstream’s refusal to pay sets a precedent for how protocol operators may handle future ransom demands following exploits—especially when attackers present themselves as white-hats but demand substantial bounties post-factum. Whether this stance will deter similar incidents or simply push hackers toward new tactics remains an open question.

What may drive the next phase

If the remaining 598 BTC stolen in the Sept. 6 Liquid Network exploit is not returned, Blockstream has stated it will escalate efforts with law enforcement, exchanges, service providers, and forensic specialists to trace the assets and identify those responsible, which could lead to immediate legal and investigative actions.