Blockstream refuses to pay ransom for the remaining 600 bitcoins

Blockstream refuses to pay ransom to recover stolen bitcoins

Blockstream has explicitly refused to pay ransom to recover stolen bitcoins from its Liquid network. In a public statement issued on September 11, 2026, the company told relevant responsible persons that it only needed to "return Bitcoin" because about 600 BTC items had not yet been returned after the exploit incident.

This refusal to pay was posted directly on the X platform by Blockstream. The company made it clear that it would not pay any fees to return stolen funds. For L-BTC holders in Southeast Asia and traders routing liquidity through trading venues connected to Liquid, the standoff is a vivid reminder of how quickly sidechain events can freeze access to funds.

Blockstream's statement on its response

Blockstream pointed out that unauthorized acquisition of assets and withholding their return is a criminal act, not a responsible security disclosure, nor is it a white hat hacking activity. The company characterized the behavior as theft rather than a bug bounty situation.

The company added that its previous communications to restore user funds were in good faith and did not constitute acceptance of the extortion clause. Blockstream said that if the funds are not returned, they will work with law enforcement, exchanges, service providers and forensic experts to track and recover the funds and identify those responsible. The statement ended with the words "Return Bitcoin."

The following is the original official statement released by Blockstream on X:

To those involved in stealing Liquid Network Bitcoin:

Blockstream will not pay ransom for the return of stolen funds. Obtaining assets without authorization and withholding them for return is a criminal act, not a responsible security disclosure. This is not a white hat event. This is...

-- Blockstream (@Blockstream) September 11, 2026

What does the remaining 600 BTC data show?

Comparison of remaining funds to total losses

The 600 BTC involved is the remaining balance, not the total amount involved in the incident. According to media reports, Liquid suspended operations on September 6, when approximately 4,000 BTC was withdrawn from the alliance wallet. Later, after Blockstream stated that the affected bridge nodes had been repaired, relevant personnel returned 3,400 BTC. This left a controversial outstanding balance; it was reported to be approximately 598.5 BTC, which is rounded to 600 BTC in the title. Currently, no current balance based on blockchain browsers has been independently verified.

Both media outlets reported that the other party demanded a 10% reward or fee. One of the media outlets attributed this to an online message shared by Blockstream co-founder Samson Mow, but the underlying transaction was not independently inspected. According to unconfirmed reports, the attackers also threatened to face a 15% loss unless they were paid, but this statement was not an established or agreed customer discount rate. No dollar conversion is applied here because the valuation at the time of the event has not been established.

Unverified details in Liquid vulnerability report

Event details and recovery status

Critical parts of the event have not yet been confirmed. It has been reported that a flaw in Elements allows the creation and redemption of unsupported L-BTC through Liquid withdrawals, but as of now, the official has not released a technical post-mortem analysis report, vulnerability transaction record or patch analysis. Until confirmed by Blockstream, this root cause should be considered an unverified single source account.

The current operating status is also unclear. Early reports described a blank block restart during which trading or anchoring operations were suspended, while unconfirmed reports indicated that trading was later resumed but the fund withdrawal feature remained disabled. The evidence provided did not determine the current location or recovery status of the unreturned coins.

Blockstream claims that the intention to seek legal recovery was simply a plan and not proof that a case, court order or enforcement action had begun. This is crucial for regional regulation: no ASEAN regulatory response has yet been verified, and there is no conclusive evidence of all exposure to local transactions.

Points for ASEAN Exchanges and Holders to Focus on

After the incident, Blockstream issued an official phishing warning on September 9, reminding users of impostors to use false mandatory updates, reimbursement or re-anchor claims, unsolicited private messages, and similar domain names to commit fraud. The company emphasized that the incident did not require users to transfer funds, leak recovery mnemons, re-anchor assets or install software in emails, and that the company would never ask for recovery mnemons or PIN codes.

These guidelines are directly applicable to users in places such as Jakarta, Bangkok, Manila and Singapore, which are often accompanied by waves of phishing attacks after global security incidents. Similar to other recovery-related scams, area holders should verify any re-anchoring or reimbursement information against official channels before taking any action.

At the time of the study, Bitcoin was trading at approximately US$77,137, down approximately 0.22% in 24 hours, and a price impact specific to the event had not yet been verified. The broader market appetites remain strong, and macro signals such as sticky CPI continue to dominate market attention rather than Liquid controversy. Currently, there are no confirmed loss rates and verified area losses, and the next official Blockstream update will determine whether unreturned coins will be recovered or cancelled.

Disclaimer : This article is for reference only and does not constitute financial or investment advice. There are significant risks in the cryptocurrency and digital asset markets. Before making a decision, be sure to study it yourself.