Blockstream Refuses to Pay Ransom for Stolen Bitcoin

GLOBAL — A September 6 exploit drained about 4,000 BTC — worth roughly $320 million at the time — from Liquid, a Bitcoin sidechain built by Blockstream. Most of it has since come back. Blockstream now says it will not pay to recover the rest.

The company rejected a demand for a 10% bounty from the group still holding the remaining coins, and urged them to return the funds voluntarily.

What broke, and what didn’t

Liquid is not the Bitcoin base layer. It is a federated sidechain: users lock real bitcoin with a group of functionaries and receive Liquid bitcoin, or L-BTC, to move faster and more privately. The peg is only as sound as the software and the federation behind it.

The attacker found a bug in the Elements codebase that let them create L-BTC out of thin air — tokens with no bitcoin locked behind them — then swap those unbacked units for genuine bitcoin held in the federation’s wallet. Bitcoin’s own consensus rules were never touched. The failure was in the bridge.

The bitcoin was never at risk on Bitcoin. It was at risk on the layer built beside it.

The standoff

After Blockstream confirmed that affected bridge nodes had been patched, the attackers returned about 3,400 BTC. Roughly 598 coins — some $47 million — remain outstanding, and the holders offered to give them back for a cut.

Blockstream said no. Paying attackers to return stolen assets, the company argued, is not responsible disclosure but negotiation with theft — and doing it once writes a playbook for every future exploit. It said it would work with law enforcement, exchanges, service providers and forensic specialists to trace the coins and identify those responsible.

Back online, cautiously

Liquid resumed producing blocks on September 10, and transactions flowed again the same day. Peg-outs — the step where L-BTC is redeemed for real bitcoin — stayed disabled as a precaution, the clearest sign the operators are treating the reopening as provisional.

The episode lands in a familiar place. The recurring danger in bitcoin is rarely the chain itself; it is the wrapped, pegged and bridged versions that promise its properties while depending on someone else’s code. Blockstream’s refusal is a bet that holding a hard line now is cheaper than the precedent of paying.

Why it matters: the risk sat in the sidechain, not in bitcoin — and refusing a ransom sets a precedent that shapes how every future exploit is handled.

The Sept 6 exploit size (~4,000 BTC / ~$320M), the Elements-codebase bug that minted unbacked L-BTC, the 3,400 BTC returned after patching, the ~598 BTC (~$47M) outstanding, the rejected 10% bounty, and the Sept 10 restart with peg-outs disabled are per The Block, Crypto Briefing and Cryptometer, reporting Sept 11, 2026. Informational only — not financial advice.