Blockstream refuses ransom demand after recovering 85% of stolen BTC from Liquid Network exploit

Blockstream just drew a line in the sand. After recovering roughly 3,400 BTC from the 4,000 BTC drained from its Liquid Network federation wallet on September 6, the company announced on September 11 that it will not pay a ransom for the remaining 598.5 BTC, worth approximately $47 million.

The company's position is straightforward: compensating attackers for returning stolen assets is theft negotiation, not responsible disclosure, and doing so would create a playbook for every future exploit in the industry.

The exploit targeted a software bug in the Elements codebase, the open-source framework underpinning Blockstream's Liquid sidechain. The vulnerability allowed the creation of unbacked L-BTC, the network's pegged token, which was then swapped for real BTC from the federation wallet.

Critically, this was not a compromise of the federation's signing keys. The multi-signature security model that governs Liquid's custody remained intact. The attackers exploited a logic flaw in how the network validated peg transactions.

Blockstream deployed patches quickly, and by September 7, approximately 3,400 BTC had been returned, representing about 85% of the stolen funds. The Liquid Network temporarily suspended operations during the recovery process before resuming with an updated block production program.