Blockstream has publicly refused a ransom demand from hackers responsible for exploiting its Liquid sidechain, insisting that attackers return the remaining approximately 600 bitcoin rather than allowing them to retain the funds as a reward. The incident, which initially involved the theft of over 4,000 BTC from the federated sidechain, has prompted a coordinated recovery effort as the company engages with law enforcement while gradually restoring network functionality.
According to Bitcoin Magazine, the attackers—described in reports as white hat hackers—targeted Blockstream's Liquid sidechain and extracted more than 4,000 bitcoins. While the disposition of the majority of these assets remains unclear, the perpetrators have reportedly sought to retain roughly 600 BTC as compensation for identifying the vulnerability. Blockstream has firmly rejected this proposal, demanding the complete return of all remaining assets rather than acquiescing to the hackers' terms.
The Block reports that the company has categorically refused to pay the ransom for the remaining bitcoin, signaling it will not negotiate with the attackers to allow them to keep these funds as a white hat bounty. This refusal sets up a confrontation where either the hackers voluntarily return the assets or face pursuit through legal and technical recovery channels.
Cointelegraph indicates that Blockstream has committed to working with law enforcement agencies, cryptocurrency exchanges, and blockchain forensic specialists to recover the outstanding funds should the hackers fail to comply with the return demand. This approach suggests the company is preparing for a potentially extended recovery process while maintaining public pressure on the attackers to relinquish the funds without receiving compensation.
Operationally, the Liquid network has begun restoring services following the security breach. The Block confirmed that transaction processing and block production have resumed on the sidechain; however, critical withdrawal functionality remains restricted as security measures continue. Specifically, peg-out operations—which enable users to transfer bitcoin from the Liquid sidechain back to the main Bitcoin blockchain—remain disabled while recovery work continues and the platform undergoes stabilization.
The exploit represents a substantial security challenge for the Liquid Network, which functions as a settlement layer designed to facilitate faster and more confidential Bitcoin transactions compared to the base layer. With over 4,000 BTC initially compromised and nearly 600 BTC still under hacker control according to available reports, the incident underscores persistent vulnerabilities in cross-chain infrastructure. The resolution now hinges on whether the attackers respond to Blockstream's demands or if the company's coordinated efforts with exchanges and authorities successfully reclaim the remaining assets through alternative means.