Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Blockstream refuses to pay ransom for stolen bitcoins from the Liquid Network
On September 11, Blockstream issued a statement on the X platform, making it clear that it will not pay ransom for bitcoins stolen from the Liquid Network (its joint sidechains). Earlier, an attacker who called himself a "white-hat hacker" used a flaw in transaction verification software in September to withdraw about 4,000 bitcoins, worth about $320 million, from the network's alliance reserves. Most of the funds have been recovered, but about 600 bitcoins (worth approximately $47 million) are still in the hands of the attackers.
Blockstream characterized the incident as theft
Blockstream emphasized that no ransom will be paid for the return of stolen assets and defined the incident as a criminal act rather than a responsible security disclosure. The company pointed out: "Obtaining assets without authorization and withholding them for return is a crime and is not a white hat act."
Liquid Network has suspended services after the funds were withdrawn. Blockstream warned that if the remaining funds are not returned, the company will use all legal means to trace and recover assets, including cooperating with law enforcement agencies, exchanges, service providers and forensic experts.
The process of exploit and partial capital return
According to a report from blockchain analytics firm Chainalysis, attackers took advantage of flaws in Liquid cache transaction verification checks to create unsupported L-BTC and exchange it for real Bitcoin. After Blockstream confirmed that the bridge node had been patched, the attacker returned 3,400 bitcoins (approximately 85% of the total withdrawal) in a single transaction. The remaining part was transferred as change to an address controlled by the attacker and has not been returned yet.
Chainalysis pointed out that some observers speculated that the withheld funds may constitute a de facto reward, but neither party confirmed the arrangement.
Continuing standoff
Blockstream said there was still an opportunity to resolve the matter responsibly, but warned that Bitcoin's transparency meant transactions and the evidence they left behind "will not disappear." The company mentioned that a community of engineers, cryptographers and white-hat hackers could help track funds, underscoring the rigorous scrutiny of the co-hosting model that underpins the Liquid network.
As the deadlock continues, whether the unreturned bitcoins will eventually return remains an open question.
