Blockstream rejects ransom as Liquid hackers hold nearly 600 BTC

Blockstream announced it will not accede to demands from the parties that removed Bitcoin from the Liquid Network, calling the unauthorized seizure and retention of assets a criminal act rather than responsible disclosure. The company said it had negotiated with the actors in an effort to recover user funds but declined to accept the specific terms the attackers proposed.

The attackers reportedly communicated an onchain demand for Blockstream to pay a 10% bounty from the company's own funds; this message was shared on Wednesday by Jan3 CEO and former Blockstream chief strategy officer Samson Mow. The actors warned that Liquid holders could suffer a 15% loss if their conditions were not met.

Blockstream urged the voluntary return of the remaining coins, and said it will escalate efforts by working with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible if the funds are not returned. The company previously indicated that bridge nodes had been patched after the incident, which preceded a partial return of the stolen Bitcoin.

The incident began on Sept. 6 when self-described white-hat hackers withdrew roughly 4,000 BTC from Liquid's federation wallet, prompting the network to pause operations. After 3,400 BTC were returned, Liquid restarted block production on Thursday but only produced empty blocks following emergency software updates; transfers into and out of the network remain suspended.