Blockstream refused to pay a ransom to the attackers for 600 BTC that remained with them after the attack on Liquid Network—a federated sidechain for Bitcoin. The company called the incident not a vulnerability disclosure but theft, and warned that it would seek the return of funds through law enforcement, exchanges, services, and blockchain investigation specialists.
The incident is related to the September exploit: alleged “white hat hackers” withdrew about 4,000 BTC from the reserves of the Liquid Network federation. At the market rate at the time of the attack, this was about $320 million. Later, most of the funds were returned, but about 600 BTC, or approximately $47 million, are still under the attackers’ control.
Blockstream Considers Withholding Funds Theft
Blockstream’s position is strict: the company does not intend to pay for the return of assets. In its view, the unauthorized withdrawal of funds and further retention of part of the amount cannot be considered responsible disclosure of a security issue.
“Seizing assets without permission and withholding their return is a crime, not responsible disclosure. This is not white hat activity,” Blockstream said.
After the attack, Liquid Network operations were suspended. If the remaining coins are not returned, Blockstream plans to use all legal tools: working with law enforcement agencies, crypto exchanges, service providers, and on-chain forensics experts.
Investigation capabilities here rely on two features of Bitcoin:
- the movement of funds on the Bitcoin network can be tracked;
- traces on the blockchain do not disappear.
The transparency of transactions on the blockchain helps investigate thefts: every transfer leaves a visible trace.
How the Liquid Exploit Worked
According to Chainalysis, the attackers used a vulnerability in the mechanism by which Liquid cached transaction confirmation checks. This allowed them to create unbacked L-BTC and then exchange them for real Bitcoin.
When Blockstream confirmed the bridge nodes were fixed, the attackers sent back 3,400 BTC in a single transaction. This is about 85% of the total amount withdrawn. The unreturned portion was sent as change to an address controlled by the attackers.
Some observers suggested that the withheld 600 BTC could be considered an actual reward for finding the vulnerability. However, neither Blockstream nor the other party confirmed the existence of such an agreement.
Why This Story Matters for the Market
The situation remains open. Blockstream made it clear that there is still room for responsible resolution, but at the same time emphasized that the public nature of Bitcoin makes it harder to hide the stolen asset. Any transfer leaves a trace, which means the funds may come under constant scrutiny by analysts and monitoring services.
For the cryptocurrency industry, this case became a painful reminder of several weak points at once:
- the risks of federated storage models;
- the risks of bridge infrastructure;
- the need to constantly check security even for specialized solutions.
Liquid was created as a technology for fast Bitcoin settlements, but the attack showed that technical specialization alone does not protect against vulnerabilities.
A separate question is how such incidents affect users and services where a cryptocurrency wallet is used to store or move assets. While the 600 BTC have not been returned, the conflict between Blockstream and the attackers remains unresolved, and further movement of the funds will be closely monitored by the market.
{
“@context”: “https://schema.org”,
“@type”: “Article”,
“about”: [
{
“@type”: “Organization”,
“name”: “Blockstream”
},
{
“@type”: “Product”,
“name”: “Bitcoin”
},
{
“@type”: “Product”,
“name”: “Liquid Network”
},
{
“@type”: “Organization”,
“name”: “Chainalysis”
},
{
“@type”: “Thing”,
“name”: “blockchain”
},
{
“@type”: “Thing”,
“name”: “cryptocurrency wallet”
}
]
}
