Blockstream Refuses Ransom for Remaining Liquid Network Bitcoin
The company labeled a 10% bounty demand as theft after attackers withheld nearly 600 BTC from a massive exploit.
Blockstream has officially refused to pay a ransom to attackers who drained assets from the Liquid Network, signaling a hardline stance against crypto extortion. The decision follows a dispute over the return of approximately 598.5 BTC remaining from a massive security breach.
Approximately 4,000 BTC were initially drained from the Liquid Network around September 6, 2026. While the attackers returned 3,400 BTC of the stolen funds, they withheld the remaining 598.5 BTC. The attackers, who initially presented themselves as white-hat researchers, demanded a 10% bounty to return the assets, calling Blockstream "delusional, greedy, and arrogant." In response, Blockstream rejected the demand, stating simply, "It is theft."
The Security Failure
The Liquid Network, a Bitcoin sidechain developed by Blockstream, is designed to facilitate faster transactions and confidential transfers. Blockstream attributed the vulnerability that led to the exploit to a flawed AI-related bug fix. However, the incident has been clouded by allegations of negligence; the Bitcoin Red Team claims they had warned Blockstream about the specific vulnerability before the exploit actually occurred.
Industry Implications
This standoff highlights the precarious line between ethical security research and extortion within the digital asset space. By refusing to pay the ransom, Blockstream is setting a precedent that paying attackers—even those who return a significant portion of the funds—is unacceptable. This approach contrasts with some industry players who treat such payments as bug bounties to recover lost capital.
Furthermore, the revelation that an AI-generated fix may have introduced the vulnerability raises critical questions about the reliance on automated tools for security auditing in core Bitcoin infrastructure. As AI becomes more integrated into development pipelines, the risk of "hallucinated" security patches creating new attack vectors becomes a systemic concern for the broader blockchain ecosystem.
Current Status
While Liquid has successfully restored transaction processing, the network remains in a state of partial recovery. Peg-outs, the process of moving assets from the sidechain back to the main Bitcoin blockchain, remain disabled. It remains to be seen whether the attackers will return the remaining 598.5 BTC without payment or if the funds will remain permanently lost to the exploit.