Blockstream Refuses Ransom for Bitcoin’s Return
On September 11, 2026, Blockstream publicly declared it would not pay a ransom for the return of the stolen funds, stating in an official post on X that withholding assets for payment is a crime, not responsible disclosure. For related coverage, see Liquid Network Reportedly Halted After Alleged BTC Withdrawal.
The refusal is a stance, not a resolution. Blockstream’s decision does not mean the outstanding Bitcoin has been recovered, and the company framed lawful pursuit as the alternative to negotiation.
Blockstream said it would work with law enforcement, exchanges, service providers and forensic specialists to trace and recover the funds if they were not returned. That is a stated intention, not evidence of a filed criminal case or a court finding.
According to unconfirmed reports, the exploiters demanded 10% of Blockstream’s own money as a bug bounty and threatened a 15% loss to holders, a claim Decrypt attributed to a Bitcoin transaction message that could not be independently read. Blockstream stressed that any negotiations did not signify acceptance of the actors’ terms.
$47 Million in Bitcoin Linked to the Liquid Hack
The figure at the center of the standoff is roughly $47 million, the reported dollar value of the approximately 598.5 BTC still outstanding as of Liquid’s September 8 incident update. That is an approximation for the remainder, not the original total loss.
BTC still outstanding
The dollar figure is not the ransom demanded. It is the value of what remains missing after most of the haul was already sent back.
Liquid’s incident report dates the exploit to September 6, 2026, at 15:53:10 UTC. The report attributed it to how Elements caches range-proof verifications, which allowed roughly 4,000 unbacked L-BTC to be created, as a SlowMist analysis of the minted L-BTC examined in closer detail.
The exploiters then converted that unbacked L-BTC through SideSwap’s authorized peg-out service. Critically, no federation private keys were compromised, a point that reframes this as a sidechain solvency failure rather than a key breach.
Liquid held approximately 4,205 BTC in reserve before the incident and 197 BTC afterward, once the exploit peg-out and additional withdrawals cleared before operations halted. The patch deployment to bridge nodes completed on September 7 at 01:09 UTC.
Then came the partial reversal: 3,400 BTC was returned on September 7, leaving the outstanding share at roughly 15% of the reserve, as detailed when the hackers first began returning Bitcoin.
BTC returned
3,400 BTC
The network is limping back. Liquid resumed block production and transaction processing on September 10, though peg-outs remained disabled, a status covered as recovery talks over the remaining funds continued.
Bitcoin itself traded at $77,282 at press time, up 0.47% on the day, while the broader Fear & Greed Index sat at 63, in “Greed” territory. Neither figure measures fallout from this incident.
Blockstream’s Position: ‘It Is Theft’
Blockstream’s language left no room for the “white-hat” framing the actors reportedly claimed. “Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft,” the company wrote.
To those responsible for the theft of bitcoin from the Liquid Network:
Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is…
— Blockstream (@Blockstream) September 11, 2026
Source: @Blockstream on X
That characterization is Blockstream’s own, not a legal determination. No regulator action, criminal charge or court finding has been established in connection with the incident.
Not everyone in Bitcoin circles accepted the company’s moral framing. Bitcoin commentator hodlonaut pushed back, arguing the episode is a sidechain solvency problem rather than a battle over Bitcoin’s core values.
I’m sorry this happened, and I sympathize with everyone who is affected in different ways.
But calling this a fight for Bitcoin’s principles is dishonest framing.
Bitcoin’s principles are: decentralization, secure against inflation, you can’t spend coins you don’t have.…
— hodlonaut (@hodlonaut) September 11, 2026
Source: @hodlonaut on X
The criticism echoes earlier industry skepticism. Ledger CTO Charles Guillemet also questioned the purported white-hat conduct in early reporting on the drained bridge, and the dispute over Blockstream’s security spending remains contested, mirroring the tension when Blockstream first rejected the ransom after most BTC was recovered.
So the money sits where it sits, and both sides have staked out positions they can’t easily walk back. Will forensic pressure and law enforcement pry loose the remaining Bitcoin, or has Blockstream just guaranteed a longer fight?
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
