Blockstream refuses ransom in $320M Liquid hack

Blockstream has declined to meet the ransom terms set by attackers still holding funds taken from the Liquid Network, stating it will instead coordinate with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify the perpetrators.

The company said Friday it had attempted to negotiate in good faith for the return of user funds but rejected the attackers' ultimatum. In an on-chain message posted Wednesday and shared by Jan3 CEO Samson Mow, the attackers demanded Blockstream pay a 10% bounty from its own treasury, threatening Liquid holders with a 15% loss if the company refused.

Blockstream called the demand criminal theft rather than responsible disclosure, stating that taking assets without permission and conditioning their return on payment is not white-hat conduct. The company urged the attackers to return the outstanding bitcoin voluntarily.

Operations on Liquid, a Bitcoin sidechain, were halted Sept. 6 after attackers — who described themselves as white-hat hackers — withdrew roughly 4,000 BTC, valued at approximately $320 million at the time, from the federation wallet. Following Blockstream's announcement that compromised bridge nodes had been secured, the attackers returned 3,400 BTC, leaving around 598 BTC still missing.

Block production on Liquid restarted Thursday with empty blocks after emergency software patches were deployed. Transactions and bitcoin transfers in and out of the network remain disabled.