Blockstream has refused to pay a ransom for the remaining bitcoin still held by attackers behind the Liquid exploit, telling the actors to return the roughly 600 BTC outstanding rather than a
Blockstream has refused to pay a ransom for the remaining bitcoin still held by attackers behind the Liquid exploit, telling the actors to return the roughly 600 BTC outstanding rather than accept a demanded bounty, according to September 11, 2026 reporting on the Blockstream Liquid exploit.
The refusal, reproduced in a September 11 report by Crypto.news, follows the return of a reported 3,400 BTC and reframes what some had described as a white-hat recovery into an unresolved theft that Blockstream now says it will pursue with law enforcement and forensic specialists. For related coverage, see Jeffrey Epstein's Blockstream Involvement Uncovered.
The dispute matters for holders and builders across sidechain infrastructure because it tests whether a federated Bitcoin layer treats retained funds as a negotiable bounty or a crime, even as the broader market trades higher, with Bitcoin at roughly $78,802 and up 1.88% over 24 hours at press time.
Blockstream stated it will not pay a ransom for the bitcoin still held after the Liquid exploit, per Crypto.news and a parallel September 11 report from Unchained, both of which reproduce and link the company's refusal statement.
The company rejected the characterization of the actors as white-hat and said it intends to pursue recovery through law enforcement, exchanges, service providers and forensic specialists if the funds are not returned. No filing, named agency or criminal charge has been verified, so the theft description reflects Blockstream's position rather than an adjudicated legal finding.
According to the fetched reporting, the actors demanded a 10% bounty or fee on the stolen amount, which Blockstream declined. The refusal is corroborated by two editorially reviewed reports; the original September 11 statement on X was located within Crypto.news but not separately fetched, so no direct quotation of the post is claimed here.
Ledger CTO Charles Guillemet rejected the white-hat label, and, according to Unchained, said that if the retained bitcoin represented a reward negotiated through encrypted on-chain messages, it resembled extortion. That is one named reaction, not a measurement of consensus.
The headline's 600 BTC is a rounded description. Both Crypto.news and Unchained give the outstanding amount as approximately 598.5 BTC, the balance still held after the larger tranche was returned.
Bitcoin still outstanding
≈598.5 BTC
Approximately 598.5 BTC remained outstanding after the Liquid exploit, according to September 11, 2026 reporting. The headline rounds this reported amount to 600 BTC. Source: Crypto.news.The outstanding balance and the demanded fee are distinct figures. The roughly 598.5 BTC describes what is still held, while the demanded 10% bounty describes what the actors asked for; neither number represents the total loss on its own.
The attackers returned a reported 3,400 BTC on September 7 after nearly 4,000 BTC had been withdrawn, with reporting describing recovery at roughly 85%, as detailed in Unchained's account that the Liquid attacker returned 3,400 BTC while retaining the rest.
Bitcoin returned
3,400 BTC
Attackers returned a reported 3,400 BTC on September 7, 2026. This is a reported recovery amount, not an independently reconciled on-chain balance. Source: Crypto.news.These are reported figures rather than an independently reconciled transaction ledger; no explorer-linked balances or transaction hashes were inspected, so the amounts are stated in BTC without a fixed fiat valuation at incident time.
Blockstream's initial incident notice says about 4,000 BTC was withdrawn via the SideSwap peg-out authorization key, and states that authorization key and other keys were not compromised, a distinction that separates a specific compromised path from the network as a whole.
The precise mechanism remains unverified in this research set. Crypto.news attributes the exploit to a cache-key collision in confidential transaction verification, but a technical postmortem was not directly fetched, so that mechanism should be treated as an unconfirmed report rather than established fact.
Blockstream's September 9 warning says the incident does not require users to move funds, enter recovery phrases, re-peg assets or install software sent by email, per an official phishing alert issued after impersonation attempts. Who absorbs any lasting reserve shortfall has not been publicly allocated, so no reimbursement guarantee should be inferred.
Details of the timeline and dollar-scale characterization vary across accounts, including a separate framing that Liquid Network lost around $320 million during the incident, underscoring why the exact withdrawal total remains contested pending on-chain reconciliation.
Blockstream's September 10 status update says functionary and bridge node updates were deployed and block production resumed without transactions at 10:00 UTC, while peg operations remained suspended pending BTC and LBTC reserve restoration.
As of retrieval time, Liquid's official homepage and blog banners state that issued-asset transfers have resumed while LBTC transfers and peg-out operations remain paused; the banners carry no update timestamp, so the earlier no-transactions phase should be read as historical context, not the current blanket condition.
A demand to return funds is not evidence that funds were returned. A confirmed recovery would require dated statements from Blockstream and reliably attributed on-chain transaction evidence, neither of which exists for the roughly 598.5 BTC still outstanding.
Concrete triggers to watch include the restoration of BTC and LBTC reserves that would allow peg-outs to resume, any named law-enforcement or forensic engagement, and any dated on-chain movement of the retained balance. Prior reporting on how the alleged loss unfolded over 23 minutes offers a benchmark for evaluating future timeline claims.
Blockstream refused a ransom demand tied to the bitcoin still held after the Liquid exploit, declining a reported 10% bounty on the stolen amount, subject to the source verification noted above.
No. The roughly 600 BTC describes the amount still outstanding, reported at approximately 598.5 BTC, after a reported 3,400 BTC was returned; the initial withdrawal was reported at about 4,000 BTC.
Not according to the available evidence. Blockstream has refused to pay a ransom for the outstanding balance, and no dated statement or on-chain evidence establishing its return has been verified.
The next milestone builders and holders should watch is whether Blockstream restores BTC and LBTC reserves to reopen peg-outs, and whether any named enforcement or forensic action materializes against the retained balance.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The post Blockstream Rejects Ransom Demand for 600 BTC in Liquid Exploit was initially published on Coincu.
