Preface

This article summarizes Blockstream’s response to the recent Liquid Network exploit and explains its reasoning for refusing to pay for the return of missing Bitcoin.

Following a major security incident on the Liquid sidechain that resulted in the unauthorized removal of a substantial amount of Bitcoin, Blockstream publicly declared it would not pay a ransom to recover the remaining funds. The company frames the incident as criminal theft rather than responsible disclosure and emphasizes cooperation with law enforcement, exchanges and forensic experts to trace and recover the assets. This piece explains what happened, the immediate technical details known about the exploit, the negotiations and demands reportedly made by the attackers, and Blockstream’s stated principles for handling such incidents going forward.

Lazy bag

Key takeaways: Blockstream refused to pay a ransom for roughly 598.5 BTC still held after the Liquid breach. Attackers returned most funds (about 3,400 BTC) but left nearly $47 million unreturned. Blockstream called the act theft, patched the vulnerability, resumed network operations with precautions, and pledged to pursue legal and forensic avenues rather than set a precedent of paying large ransoms.

Main Body

The Liquid Network, a Bitcoin sidechain designed to facilitate faster settlement and confidential transactions between exchanges and other participants, suffered a significant security incident when an attacker exploited a flaw related to range proof verification caching on bridge nodes. Through that vulnerability, the attacker was able to mint L-BTC that was not fully backed by reserve Bitcoin and then swap the minted tokens for reserve BTC using a federation member’s SideSwap functionality, which holds peg-out authorization keys.

The breach drained roughly 4,000 BTC from the network in a single event. Shortly after the exploit became public, the attackers returned approximately 3,400 BTC to an address controlled by the network, leaving about 598.5 BTC—valued at roughly $47 million at the time—still unmoved. Blockstream confirmed these amounts in its public statements and technical response updates.

Blockstream moved quickly to patch the affected bridge nodes, deploying an updated Elements release (v23.3.4) within about ten hours and restoring block production and transaction processing the following day. Despite resuming normal network operations, peg-outs remained disabled as a precaution while recovery efforts continued. The company also warned node operators about scammers attempting to imitate legitimate update sites, recommending caution and validated update sources.

During the immediate aftermath, reports indicated negotiations between Liquid operators and the individuals who carried out the exploit. Media and on-chain messages suggested the attackers demanded compensation, framing their actions as a response to what they described as insufficient security investment by Blockstream. In a broadcast transaction, the exploiters claimed Blockstream allocated a relatively small budget to secure assets and demanded a share of funds or a large “bug bounty.”

Blockstream rejected those demands and made an explicit public statement: it would not pay a ransom for the return of the stolen funds. The company argued that acquiescing to extortion would create a dangerous precedent, effectively obligating open-source projects and their contributors to cover losses that far exceed their financial stake in the software. Blockstream emphasized that taking assets without authorization and withholding their return is criminal behavior—not legitimate responsible disclosure or white-hat activity—and must be treated as such.

Instead of paying, Blockstream announced it would pursue recovery by working with law enforcement, exchanges and forensic specialists. The company noted that blockchain transactions leave persistent on-chain evidence and that tracing pathways could lead to recoveries or law enforcement action. In parallel, the technical team fixed the identified caching bug and released updates designed to prevent a recurrence of the same attack vector.

Blockstream also rejected the notion of imposing losses on users to cover the shortfall. The company framed Bitcoin as a scarce, costly-to-produce asset and said it would not implement any haircut on holders to finance a ransom payment. This approach is rooted in the principle that developer teams and open-source maintainers should not be forced to make stakeholders whole in response to criminal exploitation—particularly when the demanded amounts would significantly exceed the projects’ economic capacity.

Operationally, Liquid restored block production and resumed transaction processing after the emergency patch, but peg-outs remained suspended pending a final recovery phase. Network operators were urged to apply official updates promptly and to remain vigilant against phishing or false update sites. Meanwhile, forensic teams, exchanges and law enforcement agencies have been engaged to trace remaining funds, and Blockstream reiterated that it will use "every lawful avenue" to recover stolen Bitcoin if the attackers do not return it voluntarily.

In summary, the Liquid incident highlights several tensions in the cryptocurrency ecosystem: the security risks introduced by complex sidechain mechanisms, the pressures surrounding disclosure and response to discovered vulnerabilities, and the ethical and practical questions that arise when attackers seek payment for returning assets. Blockstream’s public stance is firm—refuse ransom, prioritize legal and investigative routes, fix the underlying vulnerability, and avoid establishing a precedent where criminals can extract large sums by exploiting or exposing flaws.

The company’s message closed on a direct appeal: return the bitcoin. It stressed that transaction records remain and that continued collaboration with investigators will guide recovery efforts.

Key Insights Table