Community Trust ScoreVerified
Blockstream won’t pay. Full stop. After hackers drained nearly the entire federation wallet on its Liquid Network sidechain, the company got most of it back — but 598 Bitcoin are still gone, and the ransom demand sitting in its inbox isn’t getting answered.
The breach started September 6. Self-described white-hat hackers exploited Liquid, Blockstream’s Bitcoin sidechain, and pulled roughly 4,000 Bitcoin out of the federation wallet. At the time, that haul was worth around $320 million. The wallet held about 4,200 Bitcoin before the attack — so the hackers basically cleaned it out. Blockstream scrambled, pushed emergency software patches to affected bridge nodes, and managed to claw back 3,400 Bitcoin. But 598 Bitcoin never came back. That leaves the network 85% collateralized, sitting in an awkward limbo where block production has resumed but peg-outs — the mechanism that lets users move Bitcoin in and out of the network — are still disabled. You can transact. You just can’t exit.
598 Bitcoin. Still missing. No timeline.
The Ransom Demand and Blockstream’s Answer
The hackers didn’t disappear quietly. They sent an on-chain message — the kind of move that’s become almost theatrical in crypto security incidents — warning that Liquid holders could face a 15% loss if Blockstream didn’t hand over a 10% bounty. Not from recovered funds. From Blockstream’s own money. Jan3 CEO Samson Mow shared that message publicly, which is probably how most people found out about the demand in the first place.
Blockstream’s answer was no. The company called it theft, not responsible disclosure — a pretty important distinction in the world of bug bounties and white-hat hacking, where the difference between a payout and a prosecution often comes down to whether you returned the funds first and asked questions later. Blockstream’s framing makes clear it sees this as extortion dressed up in security researcher language.
And it won’t budge. The company said it’s engaging with law enforcement and forensic specialists to track the missing Bitcoin and figure out who’s behind the exploit. It’s also been in contact with exchanges and service providers — the kind of coordination you’d expect when someone’s trying to move stolen crypto and you want to make sure it gets flagged before it disappears into a mixer or crosses a border.
The refusal is deliberate. Pay once, and every future hacker with access to a vulnerable bridge node knows there’s a negotiation to be had. Blockstream seems to be betting that holding the line now costs less than the precedent it would set by paying.
What the 85% Collateral Problem Actually Means
Liquid isn’t just some obscure testnet. It’s a real sidechain with real Bitcoin locked inside it, used by exchanges and traders who want faster settlement and more privacy than the base layer offers. When peg-outs go down, that functionality disappears. Users can still move L-BTC tokens around inside the network, but they can’t redeem them for actual Bitcoin. That’s a problem if you need liquidity.
The emergency software update — Elements v23.3.4 — patched the vulnerability that made the exploit possible. Block production came back online after the patch, though it started with empty blocks before normal transaction activity picked up again. So the network is technically running. It’s just running with a hole in its reserves.
Restoring full collateralization means getting those 598 Bitcoin back. That’s the only real path to re-enabling peg-outs. Blockstream hasn’t said how long that might take, or whether it has a fallback plan if the forensic trail goes cold. No details on that front. Unclear whether there’s a contingency fund, a timeline, or a threshold at which the company might consider other options.
The hackers taking nearly 95% of the federation wallet in a single exploit is the kind of number that makes security researchers wince. It’s not a small probe or a partial drain — it was a near-total extraction. The fact that 85% came back is genuinely notable. But 15% is still missing, and until it isn’t, the network stays hobbled.
Hub: Bitcoin price, news, and analysis
Frequently Asked Questions
What did Blockstream refuse to pay after the Liquid Network hack?
Blockstream refused to pay a 10% bounty from its own funds, a demand made by hackers who still hold 598 Bitcoin taken during the September 6 exploit of the Liquid Network.
Why are Liquid Network peg-outs still disabled?
Peg-outs remain disabled because the network is only 85% collateralized — 598 Bitcoin are still outside federation control, leaving a shortfall that prevents normal Bitcoin withdrawals from the sidechain.
Who shared the hackers’ on-chain ransom message?
Jan3 CEO Samson Mow shared the on-chain message from the hackers, which warned of a potential 15% loss for Liquid holders if Blockstream didn’t comply with the bounty demand.
Why It Matters
The refusal by Blockstream to pay the ransom highlights the growing tension between security and compliance in the cryptocurrency sector, as companies grapple with the implications of hacking incidents on their reputation and operational integrity. This event underscores the vulnerabilities inherent in sidechain technology and may prompt further scrutiny from investors and users regarding the security measures employed by blockchain projects. Additionally, the loss of a significant amount of Bitcoin could influence market sentiment and raise concerns over the safety of assets stored on lesser-known networks.
