Blockstream has stated it will not pay any ransom or bounty for the return of approximately 598.5 Bitcoin still controlled by the parties behind the recent Liquid Network exploit. The company described the withholding of the funds as a criminal act rather than white-hat activity.

In a public statement, Blockstream said it had engaged with those responsible in good faith to secure the return of stolen user funds but rejected the terms demanded. The firm warned that it would pursue every available legal avenue if the remaining Bitcoin is not returned voluntarily.

The company added that it would not be party to a precedent under which open-source software developed for the Bitcoin community requires developers to pay a ransom far exceeding their economic participation. It also noted that Bitcoin cannot be minted without costs and does not impose haircuts on users to fund such payments.

Details of the September 6 Incident

The exploit occurred on September 6, 2026, on Liquid Network, the Bitcoin sidechain developed by Blockstream. Attackers took advantage of a vulnerability in the Elements software that underpins the network. This allowed the creation of roughly 4,000 L-BTC tokens without corresponding Bitcoin held in reserve.

The unbacked L-BTC was then submitted through SideSwap’s peg-out infrastructure. SideSwap, a member of the Liquid Federation, holds a peg-out authorization key. The process resulted in the withdrawal of nearly 4,000 real Bitcoin from the federation’s reserves. At the time of the incident, those reserves held about 4,200 Bitcoin, and the withdrawn amount was valued at approximately $320 million.

Federation private keys were not compromised. The peg-out mechanism operated according to its design once the unbacked tokens were presented. Liquid Network is structured so that every L-BTC in circulation is intended to be backed one-for-one by Bitcoin held by the federation.

Partial Return of Funds

Following confirmation that bridge nodes had been patched, the parties returned approximately 3,400 Bitcoin to the Liquid Federation on September 7. That amount represented roughly 85 percent of the Bitcoin taken. Around 598.5 Bitcoin remained at an address controlled by the attackers.

The remaining balance was valued near $47 million at the time of the partial return. Block production on Liquid resumed after the release of Elements version 23.3.4, which addressed the exploited vulnerability. Transactions later began processing normally. Peg-out operations remained disabled as a precaution while recovery efforts continued. As a result, circulating L-BTC was only about 85 percent backed while the outstanding Bitcoin stayed unrecovered.

Rejection of Bounty Demand and Next Steps

Communications between Blockstream and the parties indicated a demand for a 10 percent fee calculated on the original amount taken, to be paid from Blockstream’s own resources. Failure to pay was linked to a potential 15 percent reduction for Liquid holders. Blockstream rejected the demand.

The company stated that if the remaining Bitcoin is not returned, it will work with law enforcement agencies, exchanges, service providers, and forensic specialists to trace the funds and pursue those responsible. It noted that Bitcoin’s permanent public transaction history provides lasting evidence.

Blockstream left open the possibility of a voluntary resolution without further escalation, stating there remains an opportunity to resolve the matter responsibly. Updates on network recovery have been provided publicly by figures associated with the project, including confirmation that Liquid transactions had returned to normal processing after the software update.