Blockstream has rejected demands for a bounty payment related to the Liquid Network security incident and stated it will not negotiate with the party holding stolen Bitcoin.
In a formal response, the blockchain technology company dismissed claims that the incident qualifies as responsible disclosure. Blockstream characterized taking assets without authorization and withholding them as theft rather than white-hat activity.
Recovery Efforts and Company Position
The company said it engaged in good faith to recover stolen user funds but emphasized that such efforts should not be interpreted as acceptance of the hackers' actions or demands. Blockstream stated it would not establish a precedent where open-source developers are forced to pay ransom for software built for the Bitcoin community.
"Bitcoin is hard money and can't be minted without costs; Bitcoin doesn't haircut users to pay a ransom," the company said in its statement.
Blockstream offered the party holding the funds an opportunity to return the assets and resolve the situation responsibly. If the funds are not returned, the company said it would pursue every lawful avenue available, including coordination with law enforcement, exchanges, service providers, and forensic specialists to trace the assets and identify those responsible.
Bitcoin Transaction Traceability
The company stressed that Bitcoin transactions remain visible by design, meaning the funds and evidence associated with their movement do not disappear. Samson Mow, the company's former Chief Security Officer, warned that those holding the stolen assets may be underestimating the consequences of their actions, noting they have left behind more clues than they may realize.
The Incident and Recovery Phase
Approximately 4,000 BTC was withdrawn from Liquid's Federation wallet on September 6. The alleged white-hat hackers later returned 3,400 units, while approximately 598 BTC remained in their possession.
Liquid has entered a recovery phase with block production and transactions resuming, though peg-outs remain disabled. Internal and external teams are conducting testing, code scanning, and monitoring. Liquid node operators have been instructed to update to Elements v23.3.4.
