Blockstream, a key Bitcoin infrastructure company, refused a ransom demand Sept. 11 to recover 598 Bitcoin held by hackers who exploited its Liquid Network.
The hackers demanded 10 percent of Blockstream's own funds in exchange for returning the stolen assets, according to an on-chain message shared Sept. 8 by Jan3 CEO Samson Mow, a former Blockstream chief strategy officer. They threatened a 15 percent loss to Liquid holders if the demand went unmet.
Blockstream called the incident theft, rejecting the hackers' characterization as responsible disclosure or white-hat activity.
The exploit began Sept. 6 when Liquid, a Bitcoin sidechain, paused operations. Hackers withdrew approximately 4,000 Bitcoin—valued at roughly $320 million at the time—from its federation wallet. After Blockstream patched affected bridge nodes, the actors returned 3,400 BTC, leaving 598 Bitcoin unaccounted for.
Liquid resumed block production Sept. 9 following emergency software updates, but the network produced only empty blocks. Transactions and Bitcoin transfers into and out of Liquid remain suspended.
Blockstream urged the hackers to voluntarily return the remaining Bitcoin. If they do not, the company plans to work with law enforcement, exchanges, service providers and forensic specialists to trace the stolen assets and identify those responsible.
