Blockstream has publicly refused to pay for the return of the roughly 598.5 BTC — valued at more than $46 million — still held by the actors behind the Liquid Network breach, closing a negotiation conducted partly through messages embedded in Bitcoin blocks.
The company stated on X that paying a ransom is out of the question: "We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds." It committed to working with law enforcement, exchanges and forensic specialists to trace, recover and identify those responsible.
The Dispute in Numbers
The September breach allowed the actors to create more than 4,000 LBTC on the Liquid sidechain and redeem them for actual bitcoin — an unauthorized withdrawal worth roughly $320 million at the time. After on-chain negotiation, the party returned approximately 3,400 BTC, or about 85% of the total, but retained 598.5 BTC and demanded 10% of the overall amount as a bug bounty in exchange for full restitution.
One embedded message, as reported by multiple outlets, read: "You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess." A later message called Blockstream "delusional, greedy, and arrogant" and threatened to expose the company's encrypted communications unless the demand was met.
Blockstream's framing is categorical: "Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft."
A Competing Account of What Was Known
The ransom refusal coincided with a separate dispute over whether the underlying vulnerability was reported before the breach. The Bitcoin Red Team, a volunteer group that audits Bitcoin-aligned projects and grew prominent after the Coldcard disclosures, signaled that it had previously disclosed the class of bug exploited in the incident.
Responding to Blockstream founder Adam Back's explanation that the flaw was introduced "due to an incorrect bug fix, to an AI-found bug which was also a non-critical bug," Red Team co-lead Calle wrote: "Turns out it only costs you 600 BTC to ignore an email from the red team." He called Back's account incomplete, saying Blockstream had "selectively and inaccurately mentioned the patches without complete and very clear history of acknowledgement."
Former Blockstream CSO Samson Mow rejected the insinuation, saying no emails were ignored and that the claims diminished the Red Team's professionalism. The Red Team says it will publish its own account of the disclosure process after Blockstream releases its post-mortem. These accounts conflict; neither version has been independently verified, and the disclosure history remains an open question.
Where Liquid Stands
The sidechain resumed block production on September 10 and has since re-enabled transactions, but peg-outs remain disabled as a precaution, with no announced timeline for restoration. Because the missing BTC sits outside the federation's reserves, a third party would need to deposit the shortfall for LBTC to return to full 1:1 backing.
The remainder of the recovery now runs through the channels Blockstream named: law enforcement coordination, exchange watchlists and forensic tracing — the same machinery that followed the funds home once already, this time without a bounty on the table.
TrustGrade covers the security and trust ecosystem around digital assets. For verified trust data on the platforms and firms shaping it, see trustgrade.ai.