Blockstream Rejects Ransom Demand After Liquid Bitcoin Exploit

Blockstream said on Sept. 11 it will not pay a ransom for bitcoin taken in the Sept. 6 Liquid Network exploit, after Liquid reported that 3,400 BTC had been returned and about 598.5 BTC remained outstanding. Liquid restarted block production and transactions on Sept. 10 but left peg-outs disabled while recovery work continued and a software patch was released.

By AI NewsroomPublished about 4 hours agoUpdated about 4 hours ago0 views

Why It Matters

The dispute affects user access to withdrawals because peg-outs — the mechanism to move BTC out of Liquid — remain disabled while roughly 15% of the stolen funds were still missing. Blockstream’s refusal to meet the actors’ demands means recovery will proceed through forensic tracing and coordination with law enforcement rather than negotiation.

Key Facts

Exploit date: Sept. 6, 2024 (created unbacked L-BTC)
Amount created by exploit: About 4,000 L-BTC (unbacked)
BTC released via peg-out: About 4,000 BTC
BTC returned to Liquid Federation peg wallet: 3,400 BTC returned on Sept. 7
BTC outstanding as of Sept. 8: Approximately 598.5 BTC (about 15%) as of 19:10 UTC on Sept. 8

Blockstream said on Sept. 11 it will not comply with ransom demands tied to the Liquid Network exploit that occurred on Sept. 6. The company characterized the removal and withholding of the bitcoin as theft rather than responsible disclosure and said that, if the funds are not returned voluntarily, it will coordinate with law enforcement, exchanges, service providers and forensic specialists to trace and identify those responsible.

Liquid’s incident report described how the exploit produced roughly 4,000 units of L-BTC that were not backed by bitcoin in the network reserve and that those unbacked tokens were converted into about 4,000 BTC via the standard peg-out process. The report said no private keys were exposed; instead, the attack exploited how nodes running the Elements open-source software cached range-proof verifications, which allowed the unbacked L-BTC to be accepted as valid before peg-outs were processed. The actors returned 3,400 BTC to the Liquid Federation peg wallet on Sept. 7 and left a message on the Bitcoin blockchain claiming to be white-hat researchers and asking to be contacted.

Liquid resumed block production and transaction processing on Sept. 10, but it kept peg-outs disabled as a precaution while recovery and accounting work continued. On Sept. 9 the network published an emergency Elements release, version 23.3.4, which Liquid said addresses the proof-verification cache vulnerability exploited in the incident. With peg-outs offline, users remain unable to move bitcoin out of Liquid until the recovery effort reaches its final stage.

Blockstream emphasized that prior engagement with the actors was aimed at recovering user funds and should not be seen as acceptance of any demands. The company also warned that paying a ransom could create a precedent exposing open-source Bitcoin developers to future extortion attempts. With a portion of the stolen bitcoin still outstanding, Blockstream plans to pursue tracing and enforcement options rather than make payments to the actors.