Blockstream Refuses Ransom Demand After Liquid Network Hack
Company labels the theft of remaining Bitcoin funds as a crime, declining a 10% bounty demand.
Quick Look
Blockstream refused a ransom demand from hackers holding about 598 Bitcoin on the Liquid Network, labeling the theft a crime rather than responsible disclosure and vowing to work with law enforcement.
AI-generated summary
Why It Matters
Hackers withdrew about 4,000 Bitcoin from Liquid Network's federation wallet on Sept. 6, later returning 3,400 BTC.
Bitcoin infrastructure company Blockstream said it will not pay a ransom to recover funds still held by the Liquid Network hackers.
“Taking assets without authorization and withholding their return is a crime, not responsible disclosure,” Blockstream said Friday. “It is not white-hat activity. It is theft.”
The company said it had engaged with the hackers in good faith to recover user funds but would not accept their demands.
The hackers demanded that Blockstream pay a 10% bounty from its own funds in an onchain message shared by Jan3 CEO and former Blockstream chief strategy officer Samson Mow on Wednesday. They warned that Liquid holders would otherwise face a 15% loss.
Blockstream urged the hackers to return the remaining Bitcoin voluntarily. If not, it said it would work with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible.
On Sept. 6, Liquid, a Bitcoin sidechain, paused operations after self-described white-hat hackers withdrew about 4,000 Bitcoin, then worth about $320 million, from its federation wallet.
The actors subsequently returned 3,400 BTC after Blockstream said that affected bridge nodes had been patched, leaving about 598 BTC outstanding.
Liquid resumed block production on Thursday, producing empty blocks following emergency software updates. Transactions and Bitcoin transfers into and out of the network remained suspended.
What to Watch
AI outlook — possibilities, not facts
Blockstream will work with law enforcement and exchanges to trace the assets.
Very likely · Within weeks
Open Questions
- Will law enforcement successfully identify the hackers?
- When will regular transactions resume on the Liquid Network?







