Community Trust ScoreVerified
Blockstream won’t budge. The Bitcoin infrastructure company publicly rejected a ransom demand from hackers who still hold 598 BTC taken from the Liquid Network — and it’s now leaning on law enforcement, exchanges, and forensic specialists to get the money back.
The attack started September 6. Self-proclaimed white-hat hackers pulled roughly 4,000 Bitcoin out of the Liquid Network’s federation wallet — about $320 million at the time. Blockstream moved fast, patching the affected bridge nodes, and that pressure worked well enough to push the hackers into returning 3,400 BTC. But 598 BTC never came back. The hackers wanted a 10% bounty — taken from Blockstream’s own funds, not from the recovered assets — before they’d hand over what remained. Blockstream said no. The demand itself was communicated through an onchain message shared by Jan3 CEO Samson Mow, which is a pretty unusual way to negotiate, but here we are.
598 BTC still missing. No deal.
The hackers didn’t just ask nicely, either. They threatened that Liquid Network holders would face a 15% loss if their demands weren’t met. That kind of pressure — essentially holding users hostage to force a corporate payout — is exactly what Blockstream pushed back on hard. The company’s position was blunt: taking assets without authorization is theft, not responsible ethical hacking. The “white-hat” framing the hackers used didn’t land. Blockstream had apparently been in what it called amicable discussions with the group before things broke down over the bounty demand.
What Happened to the Liquid Network
The Liquid Network is a Bitcoin sidechain, built to handle faster transactions and add a layer of privacy on top of Bitcoin’s base layer. It’s used heavily by exchanges and traders who need to move Bitcoin quickly without clogging the main chain. A breach at this level isn’t just embarrassing — it’s operationally damaging in ways that ripple out to everyone relying on it.
After the hack, Liquid paused operations entirely. Block production came back online Thursday, which sounds like progress. But it’s not really back to normal. The network is currently generating empty blocks as a precautionary step. All transactions and Bitcoin transfers remain suspended while the team pushes through additional security updates. So the lights are on, but nobody’s moving money yet.
That’s a significant operational hole for a network that exists specifically to move Bitcoin fast.
Blockstream hasn’t said much publicly beyond its core position — no ransom, working with authorities, urging the hackers to return the funds voluntarily. The company didn’t disclose further details about the ongoing investigation or any timeline for when transactions might resume.
The Recovery Push and What Comes Next
Blockstream’s plan, as far as it’s been made public, is pretty straightforward: coordinate with law enforcement, work with exchanges to flag and freeze any movement of the 598 BTC, and bring in forensic experts to trace where the funds go. That’s the standard playbook for crypto theft at this scale, and it can work — blockchain transactions are traceable in ways that cash simply isn’t. But it takes time, and sophisticated hackers know how to complicate the trail.
The company seems to be betting that refusing to pay keeps the door open for a clean legal recovery. Paying a ransom — even framed as a bounty — muddies the waters legally and, maybe more importantly, sets a precedent that Blockstream clearly doesn’t want to set. If you pay once, the next group of hackers has a data point.
And there’s probably a reputational calculation here too. Blockstream built its name on Bitcoin infrastructure. The Liquid Network is one of its flagship products. Paying a ransom to people who just drained $320 million from your flagship product isn’t a great look, even if you get the last 598 BTC back.
The emergency software patches that allowed block production to resume came fast, which suggests Blockstream’s technical team had a handle on the vulnerability quickly once it was exposed. Whether those patches are enough — or whether there are other weak points in the federation wallet structure — isn’t clear yet. The company hasn’t said.
What’s known: 3,400 BTC recovered, 598 BTC outstanding, transactions still frozen, block production running empty, and Blockstream working with authorities to chase down whoever did this.
The hackers, for their part, still haven’t returned the remaining Bitcoin.
Frequently Asked Questions
What did the Liquid Network hackers demand from Blockstream?
The hackers demanded a 10% bounty from Blockstream’s own funds in exchange for returning the remaining 598 BTC, and threatened Liquid Network holders with a 15% loss if the demand wasn’t met.
How much Bitcoin was taken from the Liquid Network and how much was recovered?
Hackers extracted approximately 4,000 Bitcoin — worth around $320 million — from the Liquid Network’s federation wallet on September 6; 3,400 BTC was returned after Blockstream patched the bridge nodes, leaving 598 BTC still unrecovered.
Why It Matters
The refusal by Blockstream to pay the ransom underscores a growing trend in the cryptocurrency sector, where companies are increasingly opting to combat cybercrime through law enforcement and technological solutions rather than capitulating to demands. This approach could set a precedent for how future incidents are handled within the industry, potentially influencing the security posture of decentralized finance (DeFi) platforms and their response strategies to hacks. Furthermore, the ongoing situation highlights the vulnerabilities within blockchain infrastructure, emphasizing the need for robust security measures as the adoption of such networks continues to rise.
