A group that drained nearly 4,000 BTC from Blockstream's Liquid Network returned 3,400 BTC but kept approximately 598.5 BTC, demanding a 10% bounty in exchange. Blockstream has rejected the demand, characterizing the incident as theft rather than legitimate security research and threatening to involve law enforcement, exchanges, and blockchain forensic specialists if the remaining funds are not returned.
The Incident and Initial Return
The drain occurred on September 6. The attackers initially claimed to be acting as white-hat researchers and communicated with Blockstream through OP_RETURN messages embedded in Bitcoin transactions. After a series of exchanges, the group returned 3,400 BTC, but approximately 598.5 BTC remained unaccounted for.
Blockstream's Response
On September 11, Blockstream stated on X that it would not pay ransom for stolen funds. The company emphasized that "taking assets without authorization and withholding their return is a crime, not responsible disclosure."
Blockstream also rejected the attackers' argument that Liquid holders should absorb losses to satisfy the demand. "Bitcoin is hard money and can't be minted without costs, Bitcoin doesn't haircut users to pay a ransom," the company wrote.
Prior Disclosure Claims
Bitcoin Red Team co-lead Calle claimed his group had warned Blockstream about the vulnerability before the exploit. Former Blockstream Chief Security Officer Samson Mow disputed this claim, stating no emails were ignored. Bitcoin Red Team indicated it plans to publish its account of the disclosure process after Blockstream releases a postmortem.
Enforcement Threats
Blockstream has stated it will work with law enforcement, exchanges, service providers, and forensic specialists to trace the remaining bitcoin and identify those responsible. The company noted that Bitcoin transactions leave a permanent public trail.
