Blockstream says it will not pay ransom for stolen Liquid bitcoins

Blockstream refused to pay a ransom for the approximately 598.5 BTC remaining in the Liquid Network breach

Earlier this week, after returning 3,400 BTC, Blockstream explicitly refused to pay ransom to those behind the scenes in exchange for the remaining Bitcoin still under its control. This incident stems from the fact that nearly 4,000 BTC was previously withdrawn from the Liquid Internet Alliance wallet.

rejects the characterization of "white hat" behavior and insists on being regarded as theft.

Blockstream rejects the person involved's description of his behavior as "responsible disclosure" or "white hat activity," and points out that unauthorized acquisition of assets and withholding returned funds is theft. The company stressed that it would not pay any ransom for the return of stolen funds.

In a statement posted on Platform X (formerly Twitter) on September 11, Blockstream said: "We will not pay ransom for the return of stolen funds. Obtaining assets without authorization and withholding them for return is a criminal act, not responsible disclosure, nor is it a white hat activity, but theft."

The statement was released after days of communication between Blockstream and unidentified persons involved. On September 6, nearly 4,000 BTC was withdrawn from Liquid's alliance wallet. Blockstream said that although the company approached those involved in good faith to recover user funds and protect the Bitcoin community, this did not mean accepting the withdrawal or subsequent conditions.

Open source developers should not be forced to pay high ransoms

Blockstream argued that when someone exploits code flaws, developers of open source Bitcoin software should not be forced to pay huge ransoms that exceed their financial interests in the project. The company pointed out: "Bitcoin is hard currency and cannot be minted without incurring costs, and Bitcoin will not pay ransoms through 'haircut'(write-down of user assets)."

The core of this controversy lies in the remaining approximately 598.5 BTC. On September 7, the persons involved returned 3,400 BTC to the Liquid Alliance Wallet, which accounted for approximately 85% of the total bitcoins withdrawn during the incident. At the time, the value of the returned funds was close to US$47 million. There is no publicly disclosed agreement authorizing those involved to keep the coins as a reward.

At first, the people involved claimed to be "white hats" and communicated with Blockstream through information embedded in Bitcoin transactions. Before returning the 3,400 BTC, they asked the company to fix the vulnerability and ensure that all affected nodes were patched. Subsequently, Blockstream confirmed through a signed message that its bridge node had been repaired and the funds could be safely returned.

It has been previously reported that after the vulnerability was fixed, the persons involved had proposed to return most of the extracted bitcoins, but did not promise to return the entire amount. As the negotiations continued, follow-up news on the chain changed the terms of the dispute. According to released information, the personnel involved asked Blockstream to use its own funds to pay a 10% reward, otherwise the Liquid holder would face losses. Currently, Blockstream has refused any payments related to the return of the remaining coins.

Technical Details and Incident Response Service

The September 6 incident involved a vulnerability that affected the Bitcoin sidechain Liquid developed by Blockstream. Nearly 4,000 BTC left the Alliance Wallet, representing most of the Bitcoin held in reserves at the time. Subsequent inspection of the Liquid Network vulnerability found that the incident originated from a cache key conflict in the confidential transaction verification logic. Blockstream said the alliance key was not compromised.

The persons involved used this flaw to obtain bitcoins from the alliance's reserves and then began to conduct online exchanges with Blockstream. During this period, Liquid suspended block production, and the exchange was also required to suspend L-BTC deposits and withdrawals. After Blockstream repaired the affected bridge nodes, the personnel involved transferred 3,400 BTC back to the alliance address, leaving approximately 598.5 BTC remaining at the address controlled by the personnel involved.

Future Action Plan: Cooperation in Tracking and Enforcement

Blockstream's latest statement draws the line between early negotiation efforts and agreeing to reward those responsible. The company said paying the requested amount would set a precedent that open source developers could be forced to fund large payments after unauthorized system withdrawals.

Blockstream told the Bitcoin community that it is continuing its efforts to help users whose funds have been taken, and thanks engineers, cryptographers and security researchers for their help in identifying and patching bitcoin-related software vulnerabilities. The company also attributed some of the security pressure on open source projects to advances in artificial intelligence, saying teams within the Bitcoin ecosystem have been working to discover and fix weaknesses in each other's products and systems.

Given that negotiations failed to achieve a full return of funds, Blockstream said that those who control the remaining bitcoins still have the opportunity to send it back, returning to the so-called standard white hat principle. If the funds remain unreturned, the company plans to work with law enforcement agencies, exchanges, service providers, forensic experts and other parties to track Bitcoin and identify those responsible.

Bitcoin transactions leave a public on-chain record, and even if the coins are later dispersed among multiple wallets, investigators can continue to view the flow of funds at addresses related to the incident. A similar tracking process has been used after other major bitcoin thefts. For example, Galaxy Research found in August that 1,561 BTC remained unmoved after researchers attributed the loss of 1,789.28 BTC to a Coldcard vulnerability. Identified attacker addresses have been shared with exchanges, compliance companies and law enforcement.

Blockstream said that Bitcoin's transparency will allow the community and investigators to continue to track evidence left behind by transactions involving Liquid funds. "Transactions will not disappear, nor will the evidence they leave."

The company reiterated that it will neither pay for the return of stolen property nor stop recovering the remaining bitcoins. "Return Bitcoin." Blockstream finally said.