Blockstream Declines Ransom Demand After Recovering Majority of Stolen Bitcoin

Blockstream, a Bitcoin sidechain operator, has announced that it will not pay a ransom for the remaining 598.5 BTC, valued at approximately $47 million, following a significant exploit of its Liquid Network. The company successfully recovered about 3,400 BTC from the 4,000 BTC that were drained from its federation wallet on September 6, 2026. Blockstream's decision is based on the belief that compensating attackers would set a dangerous precedent for future incidents in the cryptocurrency industry.

The exploit was attributed to a software bug in the Elements codebase, which underpins the Liquid sidechain. This vulnerability allowed the creation of unbacked L-BTC, the network's pegged token, which was then exchanged for actual BTC from the federation wallet. Importantly, the security model governing Liquid's custody remained intact, as the attackers did not compromise the federation's signing keys. Blockstream quickly deployed patches and resumed operations by September 7, after recovering the majority of the stolen funds.

Negotiations between Blockstream and the attackers unfolded publicly through on-chain messages, with the perpetrators initially claiming to be white hats and demanding a 10% bounty for the return of the stolen BTC. When Blockstream did not comply, the attackers escalated their threats, warning of a potential 15% loss for BTC holders. Blockstream rejected the attackers' claims of being white hats, asserting that responsible disclosure does not involve draining funds first and negotiating afterward. The company has since engaged law enforcement and forensic specialists to pursue legal recovery of the remaining stolen assets.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News