Blockstream Rejects Ransom Demand in Liquid Exploit

Blockstream has refused to pay a ransom for stolen bitcoin tied to the Liquid exploit, telling those responsible to return the coins as roughly 600 BTC remains outstanding. The company framed the withholding of assets as a crime rather than responsible disclosure, setting up a recovery fight that leans on law enforcement and forensic tracing instead of negotiation.

The dispute sits at a familiar fault line in the crypto security stack: unlike an AI safety incident that can be patched with a model rollback, a sidechain exploit leaves value in adversarial hands, and recovery depends on human refusal to pay plus off-chain tracing rather than any automated fix. This account of the Blockstream Liquid exploit is grounded in Blockstream’s own statements and directly fetched reporting; several downstream figures remain attributed rather than independently verified. For related coverage, see Bitcoin Rises as Inflation Data Put Fed Decision in Focus.

Blockstream refuses ransom demand over Liquid exploit

In a September 11, 2026 public statement, Blockstream said it “will not pay a ransom for the return of stolen funds,” directly addressing those responsible for the theft of bitcoin from the Liquid Network. The company characterized taking assets without authorization and withholding their return as a crime, not responsible disclosure and not white-hat activity. For related coverage, see XRP Regulatory Milestone in Canada, ETF Options in US.

Blockstream’s response to the ransom demand

Blockstream said it would pursue lawful recovery with law enforcement, exchanges and forensic specialists if the funds were not returned, closing its statement with “Return the bitcoin,” according to Decrypt’s reporting. The full closing line did not appear in the directly retrieved statement excerpt, so it is attributed here to that report.

The refusal itself, however, is drawn directly from the official post rather than a paraphrase. Blockstream’s stance echoes the scrutiny the firm has faced on other fronts, including when its CEO publicly refuted a reported Epstein connection, a reminder that the company tends to respond to pressure with categorical statements.

To those responsible for the theft of bitcoin from the Liquid Network:

Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is…

— Blockstream (@Blockstream) September 11, 2026

Source: @Blockstream on X

Two days earlier, on September 9, Blockstream published a security alert acknowledging the Liquid incident and warning of follow-on phishing. That official alert told users they do not need to move funds, enter a recovery phrase, check reimbursement, re-peg assets, or install software sent by email.

The same alert stressed that Blockstream will never request a recovery phrase or PIN, nor ask users to send funds anywhere, and it identified help.blockstream.com as the only support channel. Those instructions target the reimbursement and re-peg lures that typically follow a high-profile exploit, when attackers impersonate the affected protocol.

What is known about the remaining 600 BTC?

The headline figure of 600 BTC should be read only as the amount described as still outstanding from the exploit, not as the total stolen, the ransom amount, or a confirmed current on-chain balance. The account here reflects the supplied reporting, and the underlying address balance was not independently verified.

What the 600 BTC figure establishes

Decrypt’s September 11 report gives the outstanding amount as 598.5 BTC, slightly below the rounded 600 BTC in the headline, and links it to a bitcoin address. The Block separately framed the remainder as 600 BTC, according to unconfirmed reports that could not be independently read.

Most of the stolen value has reportedly already moved back. Decrypt reports that attackers returned 3,400 BTC on Monday, September 7, roughly 85% of what was taken.

According to the same report, around 4,000 BTC was drained on Sunday, September 6, with a reported incident valuation of about $320 million; both the original amount and dollar figure are described as approximate. Bitcoin was trading near $77,000 across the reporting window, a level that also framed a broader market correction below $77,000, though no causal link between that move and the exploit has been established.

Exploit scope and recovery details remain unverified

Decrypt attributes the exploit to a flaw in caching range-proof verifications that allowed unbacked L-BTC to be minted and exchanged for reserve BTC through SideSwap, though no technical postmortem was independently fetched. This is a reserve-backing failure at the sidechain accounting layer, not a break in Bitcoin’s base protocol.

According to unconfirmed reports carried by Decrypt, the attackers’ on-chain message requested 10% of Blockstream’s own funds and threatened a 15% holder loss; the transaction itself was not decoded or independently verified, and these attacker allegations should not be treated as fact. The linked bitcoin address returned only a JavaScript application shell when fetched, so no live balance or transaction record could be confirmed.

Liquid resumed block production and transaction processing on Thursday, September 10, while peg-outs remained disabled as a precaution, per Decrypt’s account of the reporting window. Whether the remaining funds are ever recovered now depends on the human and legal layers Blockstream named, not on any automated clawback, a limitation that also shapes how AI-assisted security tooling is being benchmarked against Bitcoin as adversarial capability grows across the compute stack.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.