Bitcoin infrastructure company Blockstream has ended negotiations with hackers who withdrew 4,000 bitcoins from its Liquid sidechain, declining to pay ransom for the return of the remaining funds.
Stolen funds and ransom dispute
Hackers exploited the Liquid network, a layer-2 solution developed by Blockstream designed to facilitate fast, confidential transfers of assets backed 1:1 by bitcoin. The exploit allowed the attackers to create more than 4,000 LBTC and redeem them for actual bitcoins, resulting in the unauthorized withdrawal of roughly $320 million.
After initial communication with Blockstream, the attackers returned most of the stolen coins. However, they kept 598.5 bitcoins, valued at over $46 million, and demanded 10% of the total amount as a bug bounty in exchange for full restitution.
Blockstream stated publicly on X that it will not pay a ransom, stressing that, “Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.”
Blockstream declared that paying a ransom for the return of the bitcoins is out of the question: “We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds.”
Ongoing threat and hacker demands
The hackers communicated with Blockstream using messages embedded in Bitcoin blocks. In their messages, they urged Blockstream to address the exploit immediately, promising to return the funds once the bug was fixed. Their most recent message accused Blockstream of being “delusional, greedy, and arrogant,” threatening to expose all of Blockstream’s encrypted communications unless allowed to keep 10% of the stolen bitcoins.
One of the messages read, “You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess.”
Blockstream’s response and community impact
Blockstream affirmed its commitment to collaborating with law enforcement agencies, exchanges, forensic specialists, and other stakeholders to track, recover, and identify those responsible for the incident.
Liquid, launched by Blockstream, is a notable second-layer solution designed to enhance the capabilities of the Bitcoin network by enabling rapid, low-cost, and confidential settlement of digital assets, including LBTC. LBTC tokens are pegged to bitcoin, offering users a way to transact on the Liquid network with trustless conversion back to bitcoin.
Mini dictionary: Blockstream is a leading bitcoin infrastructure technology company known for its development of the Liquid sidechain and contributions to Bitcoin’s layer-2 solutions.
The theft followed a recent trend of high-profile bitcoin security breaches. In July, hackers also targeted Coldcard wallet holders, siphoning more than 1,800 bitcoins valued near $140 million. Coinkite, the company behind Coldcard, reportedly left wallets vulnerable due to reliance on an insecure random number generator, which enabled attackers to guess users’ seed phrases.
| Liquid Exploit | Coldcard Wallet Hack | |
|---|---|---|
| Date | September 2026 | July 2026 |
| Total Bitcoins Stolen | 4,000 | 1,800 |
| Value | $320 million | $140 million |
| Returned/Recovered | Returned most, 598.5 unreturned | Not recovered |
| Exploit Method | Inflation bug on Layer-2 | Weak random number generator |
Both incidents have heightened concerns over security standards within the broader Bitcoin ecosystem, driving ongoing efforts to strengthen infrastructure and collaboration between stakeholders.
