Blockstream Refuses Ransom for Return of $47M in Bitcoin from Liquid Hack: 'It Is Theft'

In brief

• Blockstream said it will not "pay a ransom" for the return of about 598.5 BTC still held after the Liquid exploit.
• The hackers returned 3,400 BTC on Monday, about 85% of what was taken.
• The company said it will work with law enforcement, exchanges and forensic specialists to trace the rest should it not be returned.

Blockstream has refused to pay for the return of the $47 million in Bitcoin still missing from the Liquid Network, abandoning days of negotiation with the people who took it.

"Taking assets without authorization and withholding their return is a crime, not responsible disclosure," the company said on Friday. "It is not white-hat activity. It is theft."

Around 4,000 BTC was drained from the sidechain on Sunday, worth about $320 million. The attackers returned 3,400 BTC on Monday, leaving 598.5 BTC at the address they withdrew to, where it remains unmoved.

A flaw in how Liquid nodes cache range proof verifications let the attackers mint unbacked L-BTC and swap it for reserve Bitcoin through SideSwap, a federation member holding a peg-out authorization key. The reserve fell to 197 BTC. Blockstream patched the bridge nodes within ten hours and shipped Elements v23.3.4 on Wednesday. Liquid resumed producing blocks and processing transactions Thursday, though peg-outs stay disabled as a precaution while "the final stage of recovery" continues. It warned separately of scammers targeting node operators with fake update sites.