Blockstream refuses extortion request, Liquid hacker holds 600 bitcoins

Blockstream refused to negotiate with Liquid network vulnerability attackers and characterized extortion as a criminal.

Blockstream, a blockchain infrastructure company, issued a statement saying that it would not conduct any negotiations on hacker extortion requests in the Liquid Network vulnerability incident. The company pointed out that withholding other people's funds is a criminal act, not a so-called legitimate "disclosure" effort. Blockstream emphasized that although it had previously approached attackers in good faith in an attempt to recover user assets, it firmly refused to pay any bounty request from its own funds.

Core Points of the Incident

• Refusal to blackmail: Blockstream rejected the hacker's request for a "reward" through online messages, characterized it as theft, and denied that it was a responsible security disclosure.
• Funding status: It has been reported that approximately 3,400 BTC has been returned after the Liquid incident, and approximately 598 BTC is still outstanding.
• Network recovery status: Although Liquid has resumed block production after an emergency update, the network's transactions and Bitcoin transfer-in and transfer-out functions are still suspended.
• Law enforcement intervention: Blockstream stated that if assets are not voluntarily returned, it will work with law enforcement agencies, exchanges, service providers and forensic experts to address the matter.

Blockstream draws a line on blackmail demands

Blockstream pointed out that the act of attackers obtaining assets without authorization and withholding them for return should be considered a crime rather than a security interference. The company positioned its response as an all-out effort to recover user funds without accepting the attacker clause.

According to Blockstream, they had previously approached hackers in good faith with the aim of retrieving user assets. However, when the hacker made a further request-that is, via an on-chain message, requesting Blockstream to pay a 10% reward from its own funds-the contact was terminated. Blockstream said the requirements were accompanied by warnings that Liquid holders would face further losses if they did not meet the conditions. In broader public discussions, the reward request was linked to Jan3's organizational account and information shared by former Blockstream executive Samson Mow.

The beginning and end of the Liquid vulnerability incident and outstanding issues

Liquid is a Bitcoin sidechain that runs based on a consortium model. Liquid suspended operations on September 6 after attackers who called themselves "white hats" withdrew approximately 4,000 BTC (worth approximately $320 million at the time) from the Liquid Alliance wallet. In the following days, the attacker reportedly returned 3,400 BTC after Blockstream said the affected bridge nodes had been patched. This partial refund resulted in approximately 598 BTC still outstanding.

Liquid has since begun work on recovery: Blockstream announced that it has resumed block production following an emergency software update on Thursday. However, this recovery did not fully restore normal activities. Although the network generated empty blocks, transactions involving the Liquid network and Bitcoin transfer-in and transfer-out functions were still suspended. This is an important distinction for users trying to understand whether access and billing are actually restored.

Blockstream's current position indicates that the company views the remaining funds as objects that remain illegally held and subject to legal and investigative procedures, rather than as pending matters that require further payments to be settled.

What Blockstream refuses to negotiate means for users and market participants

For Liquid users, the difference between responding to security patches and negotiating payments is not just a semantic difference. Blockstream's stance will affect how exchanges, custodial services and liquidity operators handle disputed assets and extraction processes during the partial suspension of the network.

If the remaining BTC is still associated with unauthorized access, market participants will face practical questions: Will certain transfers be allowed? If funds are tracked, what compliance steps need to be taken? And how to deal with any claims made by vulnerability attackers? Blockstream's call for coordination with law enforcement agencies, exchanges, service providers and forensics experts suggests it expects to resolve the issue through investigations and institutional processes rather than continuing direct settlements with perpetrators.

In addition, this involves potential trust issues. Liquid's alliances rely on coordination among participants and the integrity of the bridging mechanism. By accusing the attacker of theft and rejecting the reward request, Blockstream is effectively telling stakeholders not to use "white hat" packaging as a substitute for legal legitimacy or user consent.

Meanwhile, Liquid has demonstrated technical responsiveness: It has released emergency updates, fixed bridge node issues, and resumed block production. This hybrid strategy-some operational resumption on infrastructure, coupled with a tough legal stance on remaining assets-helps explain why the network is technically active while still restricting user transfers.

Follow-up focus

The current focus is whether the remaining approximately 598 BTC will be voluntarily returned, or whether Blockstream plans to escalate the situation to authorities and investigative partners, leading to identification and recovery actions. In addition, users should pay close attention to when (and how) Liquid's suspension on transactions and transfers of Bitcoin into and out of the network is lifted after the latest update-and whether additional security confirmations are needed before operations can be fully resumed.