Blockstream refuses reward request after 3400 BTC were recovered

Blockstream refused to pay a reward to attackers, saying the theft was a crime rather than a bona fide security disclosure

Blockstream refused to pay a reward demanded by an attacker who stole Bitcoin from the Liquid Network, even after the attacker returned 3,400 BTC. The company made it clear that the asset theft was a criminal act, not a responsible disclosure of security breaches or "white hat" hacking.

Core Points

• The incident involved an attacker transferring funds from Blockstream's Liquid Network.
• It was reported that 3,400 BTC was returned to Liquid Alliance Wallet.
• Blockstream subsequently refused the attacker's request for a reward.
• Blockstream is the operating company behind Liquid Network, a Bitcoin sidechain (stand-alone blockchain) built for faster and more private transmission.

Liquid Network once had funds emptied, and then someone asked for remuneration before they were willing to return the funds. In response, Blockstream publicly stated in a statement issued on the X platform on September 11, 2026 that it would not pay ransom. The company emphasized that unauthorized acquisition and seizure of assets is a criminal act, does not constitute responsible disclosure, nor is it a so-called "white hat" activity.

Original official statement

The following is the complete statement of Blockstream's refusal to pay for readers to read directly:

To those responsible for stealing Bitcoin from the Liquid Network:

Blockstream will not pay any extortion fees to return stolen funds. Obtaining assets without authorization and withholding them for return is a criminal act and is not a responsible disclosure. This is not white hat behavior either. This is...

-- Blockstream (@Blockstream) September 11, 2026

The return of 3,400 BTC came first, followed by rejection

Before Blockstream officially rejected it, most of the lost coins had been returned. According to a report by crypto.news on September 11, 2026, 3,400 BTC was returned to Liquid Alliance Wallet on September 7, 2026. Unchained also confirmed this amount. However, specific recovery transaction records were not independently verified in the study.

It is worth noting that these returned funds do not represent the full picture of the incident. crypto.news reported that on September 6, 2026, almost 4,000 BTC was withdrawn from the alliance wallet. This figure is only an approximation in the report and is not a transaction by transaction audit.

This leaves a gap. Both crypto.news and Unchained stated that the unrecovered amount was approximately 598.5 BTC. The widely used figure of "600 BTC" is the result of rounding rather than an accurately observed balance.

The important thing is that the current timeline established is very narrow. The return of the funds occurred before the rejection statement, but we cannot know exactly when the reward request was made or who controlled the receiving wallet.

How did funds initially flow?

Regarding the explanation for the flow of funds, Unchained quoted Liquid trading platform SideSwap as saying that 4,000 L-BTC arrived at its Peg-out (Exit Anchor) service at 14:05 UTC, and approximately 4,000 BTC was paid approximately 23 minutes later. SideSwap reported that its system and Peg-out authorization keys were not compromised.

Details still to be confirmed in the bounty controversy

The core of the controversy is how to define attacker behavior. Bounty demands from money stealers are very different from the official vulnerability bounty program, in which companies invite researchers and agree in advance to pay for disclosed flaws. As of now, there has been no publicly disclosed evidence of an agreement that allows attackers to retain funds.

The reward request itself is only partially recorded. crypto.news reported that online messaging requires a 10% reward from Blockstream, but the original information and exact calculation base have not been independently verified. Some media have described the figure of US$50 million, but the figure comes from suppressed reports and, according to unconfirmed sources, cannot be regarded as a fixed amount.

Industry insiders are skeptical of the "white hat" term. Unchained reported that Ledger CTO Charles Guillemet questioned the label and said negotiated rewards involving retaining funds looked more like extortion. This is a paraphrasing of his views rather than a direct quote.

Risk warning for users

Blockstream also warns users to be aware of the second wave of risks. In its security notice issued on September 9, the company said the impostor was posing as Liquid, Blockstream and support personnel. Scammers often sneak in after a hacker attack, hoping that panicked users will click on malicious links.

Practical suggestions for ordinary holders are as follows: Blockstream stated that this incident does not require you to move funds, enter recovery mnemons, check refunds, re-anchor assets, or install software sent via email. Anyone who asks you to do this is likely a fraud and not an official company official.

This is the same pattern seen in other security scares, such as when Revolut faces false official requests. The safest thing to do is to ignore unsolicited information and only verify it through official channels.

Subsequent developments and Disclaimer

There are still several key details to be verified: the exact reward amount requested, the full reasons behind Blockstream's rejection, and the final destination of the remaining funds. Blockstream has characterized theft and seizure as crimes and said it will work with law enforcement, exchanges and forensic experts, although it has not yet been confirmed whether there have been charges or designated agencies involved.

In terms of the broader market context, at the time of writing, Bitcoin was trading at close to US$77,139, with little change during the day. The price reflects current market conditions and should not be seen as a reaction to this event.

Disclaimer : This article is for information reference only and does not constitute financial or investment advice. There are significant risks in the cryptocurrency and digital asset markets. Be sure to conduct independent research before making a decision.