Blockstream Rejects Ransom Demand, Demands Return of 598.5 BTC

Blockstream, the prominent blockchain technology firm, has officially rejected a 10% ransom demand from an individual responsible for an exploit on the Liquid Network. The company is demanding the immediate return of the remaining 598.5 Bitcoin (BTC), which was withheld following a security breach. This development follows a partial recovery of funds, marking a shift from a potential white-hat negotiation to a criminal investigation.

Escalation After Partial Fund Recovery

The situation began after an attacker exploited a vulnerability in the Liquid Network bridge node. While the perpetrator initially returned 3,400 BTC after Blockstream confirmed the security flaw had been patched, they retained a significant portion of the assets. The remaining 598.5 BTC is currently valued at approximately $37.3 million based on market rates as of September 2026.

• Total assets initially compromised: 3,998.5 BTC
• Assets returned following patch confirmation: 3,400 BTC
• Assets currently withheld by the attacker: 598.5 BTC
• Ransom demand rejected by Blockstream: 10% of the total

Legal Stance and Ethical Categorization

Blockstream has taken a firm stance against the attacker's attempt to frame the event as a security bounty or a responsible disclosure. The company has clarified that the retention of funds without authorization transforms the act into outright theft.

Unauthorized acquisition of assets and refusal to return them constitutes a criminal act, not a responsible disclosure; this is by no means white-hat hacking, but outright theft.

Industry experts note that white-hat hacking typically involves discovering vulnerabilities and reporting them without moving funds for personal gain, or returning all funds immediately upon request. By demanding a percentage of the loot as a condition for the return of the rest, the attacker has moved into the realm of extortion, according to Blockstream representatives.

The resolution of this case remains critical for the security reputation of the Liquid Network, a sidechain designed for faster and more confidential transactions. Blockstream has signaled that it will continue to pursue the recovery of the remaining digital assets through legal and technical channels, emphasizing that criminal acts will not be rewarded under the guise of security research.