Blockstream announced that it will not pay a ransom for the return of approximately 598.5 BTC still missing following the recent exploit of the Liquid Network, despite days of negotiations with those responsible for the theft.
Major Liquid Network exploit drains 4,000 BTC
The Liquid Network, operated by Blockstream as a Bitcoin sidechain, suffered an attack on Sunday that allowed exploiters to drain about 4,000 BTC from its reserves, valued at roughly $320 million. A vulnerability in the way Liquid nodes handle range proof verifications enabled the attackers to mint unbacked L-BTC tokens, which were then swapped for real Bitcoin through SideSwap. SideSwap, a federation member with peg-out authorization, unknowingly enabled this transfer. The network’s Bitcoin reserves fell to 197 BTC as a result.
Blockstream quickly addressed the breach, patching the compromised bridge nodes within ten hours and releasing Elements v23.3.4 by Wednesday. By Thursday, the Liquid Network had resumed block production and transaction processing, though peg-outs remain disabled as an additional precaution. The company has also warned node operators against scammers promoting fraudulent update sites amid the ongoing recovery efforts.
Negotiations break down over ransom demands
On Monday, the attackers returned 3,400 BTC to Blockstream, equating to roughly 85% of the stolen funds, but retained 598.5 BTC, which remains at the original withdrawal address. These negotiations were conducted publicly, with the exploiters writing in a Bitcoin transaction that Blockstream had allocated “only $1.5M (maybe even 0) to secure $5B assets,” and accused the company of “a flagrant neglect of security.” The attackers demanded a 10% bug bounty, threatening that Blockstream’s refusal would result in a 15% loss for holders because of the company’s “irresponsibility and stinginess.”
Blockstream stated that its involvement in these discussions “should not be mistaken for acceptance of the actions taken nor of the terms being demanded.” The company clarified that it will not agree to the precedent that open-source software developers should pay ransoms vastly exceeding their economic participation, and reiterated that it will not cover users’ shortfalls, emphasizing, “Bitcoin is hard money and can’t be minted without costs.”
Instead, Blockstream committed to working with law enforcement agencies, cryptocurrency exchanges, and forensic experts to track and recover the missing funds if they are not voluntarily returned. “Transactions do not disappear, and neither does the evidence they leave behind,” the company warned, urging the attackers to return the Bitcoin.
Ongoing monitoring and investor response
Tuesday’s report indicated that negotiations with the attackers, whom the company described as “white hat hackers,” were continuing to secure the full recovery of the liquidated assets. The incident has highlighted the risks involved in digital asset custody and the ongoing need for robust security measures across blockchain networks.
In a market where a single Fed decision or a sudden altcoin listing can change everything in seconds, the importance of fluid market monitoring has become increasingly apparent. Many investors are turning to privacy-first tools such as CryptoAppsy, which allows users to consolidate charts, news, and portfolio tracking in one interface. CryptoAppsy offers real-time charts, smart price alerts, coin-specific news, and essential macro data, without requiring users to create an account, addressing many of the informational gaps revealed by incidents like the Liquid Network exploit.
As recovery efforts continue, Blockstream has kept peg-outs disabled on the Liquid Network during what it describes as “the final stage of recovery,” maintaining a cautious approach until all vulnerabilities are addressed and missing funds are resolved.
The attackers highlighted the scale of assets under Blockstream’s care compared to the resources allocated for security, claiming that users would suffer unnecessary losses unless their demands were met.
The situation remains fluid as Blockstream continues legal and investigative actions while warning its community about potential scams targeting node operators during this period.
Industry observers are watching the outcome closely, as the final recovery of the Bitcoin reserves could set significant precedents for future protocol-level security incidents and the handling of ransom demands within the wider ecosystem.
