Blockstream Refuses Ransom Demand as Liquid Hackers Hold 600 BTC

Blockstream says it will not negotiate with the parties it describes as hackers behind the recent Liquid Network incident, insisting that the demand for a bounty amounts to theft rather than “responsible disclosure.” In a statement posted Friday, the Bitcoin infrastructure firm said it engaged with the attackers in good faith to recover user funds, but will not comply with their conditions.

The dispute centers on remaining Bitcoin held after the Liquid federation network was disrupted earlier this month. Blockstream argues the actors’ behavior crossed a clear line: taking assets without authorization and withholding their return is a crime, not an attempt to improve security.

Key takeaways

• Blockstream rejects a demanded “bounty” payment and says the remaining funds should be returned voluntarily.
• Following engagement attempts, Blockstream says it will escalate by working with law enforcement, exchanges, service providers, and forensic specialists if funds aren’t returned.
• The incident began after self-described “white-hat” actors withdrew roughly 4,000 BTC from Liquid’s federation wallet.
• After bridge nodes were patched, about 3,400 BTC were returned, leaving approximately 598 BTC outstanding.
• Liquid resumed block production with emergency updates, but transactions and transfers into or out of the network remained suspended at the time of the report.

Blockstream draws a hard line on “bounty” demands

Blockstream’s position is unambiguous: it will not pay to regain assets it says were taken without authorization. The company called the behavior “theft,” adding that it does not qualify as white-hat activity or responsible disclosure.

Blockstream also addressed the timing and intent of its interactions. According to the company, it worked with the hackers in good faith to attempt to recover user funds, but the firm will not accept the attackers’ demands.

Those demands, as described in the reporting, were presented via an onchain message. The message reportedly asked Blockstream to pay a bounty equal to 10% of the requested amount using its own funds, while threatening Liquid holders with a 15% loss if Blockstream did not comply. The onchain appeal was shared publicly by Jan3 CEO and former Blockstream chief strategy officer Samson Mow.

In its response, Blockstream urged the remaining Bitcoin holders to return what’s still at issue without further conditions. If voluntary return does not happen, the firm indicated it will pursue tracing and identification—leveraging cooperation with law enforcement, exchanges, service providers, and forensic specialists.

What happened to Liquid—and what returned so far

Liquid is a Bitcoin sidechain that relies on a federation model. The disruption came after self-described “white-hat” actors removed roughly 4,000 BTC from Liquid’s federation wallet. At the time, the amount was reported as worth about $320 million.

Following that withdrawal, Liquid paused operations. The reported pause reflected the urgency of the situation: bridge-related components and network procedures needed emergency attention before normal activity could resume safely.

Later, after Blockstream said affected bridge nodes were patched, the actors returned 3,400 BTC. That left around 598 BTC still outstanding, according to the subsequent reporting referenced in this article.

Blockstream’s latest statement frames the remaining balance as funds that should never have been withheld in the first place. The company’s escalation plan—moving from engagement to potential investigative and legal coordination—signals that it sees the situation less as a negotiated remediation and more as a recoverable loss that requires external enforcement support.

Liquid network status: resumed block production, suspended transfers

Liquid’s recovery has been partial and operationally cautious. After emergency software updates, the network resumed block production. However, the resumed production produced empty blocks, reflecting that core transaction flows were not fully restored immediately after the fixes.

At the same point in the timeline described in the article, transactions and Bitcoin transfers into and out of Liquid remained suspended. This matters for users because even when a network is “running” again in terms of producing blocks, it may still be functionally limited—particularly if transfers depend on bridge components or other safeguards that require additional validation.

The contrast between resumed block production and ongoing suspension of transfers highlights a common post-incident reality for sidechain and federation-based systems: restoring consensus activity is not the same as restoring end-to-end movement of assets. Users and integrators typically need certainty that both issuance and redemption pathways are secure before reactivating deposit and withdrawal workflows.

Why Blockstream’s refusal to pay changes the dynamic

Refusing to pay a demanded bounty can matter as much for incentives as for outcomes. When attackers attempt to convert exposure into payment, companies must decide whether negotiating sets a precedent that encourages future incidents. Blockstream appears to be choosing the deterrence route—arguing that paying would legitimize unauthorized appropriation as a “disclosure” process.

The firm’s approach also shifts the practical path to resolution. Rather than relying on the attackers to continue responding to pressure, Blockstream is signaling a move toward forensic tracking and coordinated action with third parties that can help identify flows and locate responsible parties. That includes exchanges and service providers that may be able to freeze or trace funds, depending on jurisdiction and access.

There is also a tension in the broader narrative: the attackers previously described the actions as “white-hat,” and a portion of funds has already been returned after technical remediation. But Blockstream’s messaging stresses that returning some assets does not absolve withholding the remainder under a payment threat.

For Liquid users, the key uncertainty remains straightforward: whether the roughly 598 BTC still held in connection with the incident will be returned without further conditions. Even if the network resumes certain functions, asset recovery timelines may depend on the interaction between technical fixes, the ability to trace funds, and any legal or regulatory steps that follow.

Going forward, traders, wallets, and bridge operators should watch for updates on whether Liquid transfers remain suspended, whether additional emergency patches are required, and—most importantly—whether the remaining Bitcoin is returned in line with Blockstream’s demand for voluntary restoration rather than conditional payment.