Bitcoin infrastructure company Blockstream announced Friday that it will not pay a ransom to recover funds still held by Liquid Network hackers following a September 6 security incident.
The ransom demand and Blockstream's response
The hackers demanded that Blockstream pay a 10% bounty from its own funds, warning that Liquid holders would otherwise face a 15% loss. The demand was shared in an onchain message by Jan3 CEO and former Blockstream chief strategy officer Samson Mow.
Blockstream rejected the demand, stating: "Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft." The company said it had engaged with the hackers in good faith to recover user funds but would not accept their demands.
The incident and current status
On September 6, the Liquid Bitcoin sidechain paused operations after self-described white-hat hackers withdrew approximately 4,000 Bitcoin from its federation wallet. The actors subsequently returned 3,400 BTC after Blockstream patched affected bridge nodes, leaving about 598 BTC outstanding.
Liquid resumed block production on Thursday, producing empty blocks following emergency software updates. Transactions and Bitcoin transfers into and out of the network remained suspended.
Next steps
Blockstream urged the hackers to return the remaining Bitcoin voluntarily. If they do not, Blockstream said it would work with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible.
