TLDR
Blockstream said it will not pay a ransom to recover nearly 598 BTC still held by the attackers.
The Sept. 6 Liquid Network exploit drained almost 4,000 BTC from federation reserves.
Attackers later returned about 3,400 BTC, representing roughly 85% of the stolen funds.
Blockstream released Elements v23.3.4 to fix the vulnerability used during the attack.
Liquid Network transactions have resumed, but L-BTC remains only about 85% backed.
Blockstream warned that it may pursue legal action if the remaining Bitcoin is not returned.
Blockstream has rejected any ransom payment to the group behind the recent Liquid Network exploit, saying the remaining Bitcoin must be returned. The company said the incident does not qualify as white-hat hacking because the attackers took assets without permission and still control part of the stolen funds. The dispute now centers on nearly 600 BTC that remain outside federation control.
Blockstream Draws Line Over Liquid Network Bitcoin
Blockstream said it engaged with the attackers in good faith to recover user funds. However, the company stated that it will not pay for the return of stolen property. It also warned that it could pursue legal action if the remaining Bitcoin is not returned.
The company said paying a large bounty would create a poor standard for open-source developers. Blockstream argued that Bitcoin users should not absorb losses so attackers can receive a ransom. It also said Bitcoin cannot be created cheaply to cover such demands.
The Sept. 6 attack targeted Liquid Network, a Bitcoin sidechain developed by Blockstream. The attackers used a software flaw to create about 4,000 L-BTC without placing matching BTC behind those tokens. They then used SideSwap’s peg-out system to receive real Bitcoin from federation reserves.
Liquid Network held about 4,200 BTC before the attack. The exploit removed nearly 95% of those reserves, worth about $320 million at the time. Around 3,400 BTC later returned to the federation, leaving about 598.5 BTC under attacker control.
Liquid Network Starts Controlled Recovery
Blockstream released Elements v23.3.4 to fix the exploited weakness. Block production has resumed, and network transactions are processing again. Samson Mow, a former Blockstream executive, has also shared updates on the recovery process.
Mow said L-BTC remains about 85% backed while the missing Bitcoin stays outside federation control. The network therefore continues operating with reduced backing until the final amount returns or another solution is reached.
Blockstream said Bitcoin transactions remain visible on the public blockchain, allowing investigators to follow fund movements. The company warned that records connected to the exploit will remain available and could support future legal action.
At the same time, Blockstream left open a path for the attackers to return the remaining coins without further escalation. The company said a voluntary return could resolve the dispute and restore full backing for Liquid Network Bitcoin held by its federation members.
