Blockstream has officially refused to pay a ransom to recover 598.5 BTC held by the Liquid Network exploiter as of September 11, 2026. The company’s decision leaves $47 million worth of assets stranded in the hands of the hacker, who demanded payment directly from the developers’ pockets.
The breach began on September 6, 2026. Nearly 4,000 BTC, valued at roughly $320 million at the time of the incident, was drained from the Liquid Network federation wallet. The exploit took advantage of a cache-key collision vulnerability within the confidential transaction verification logic. Blockstream confirmed that federation keys remained secure and were not compromised. Instead, the vulnerability resided in a VPN network appliance used by the team for system maintenance access.
A 10 Percent Demand and Bogus White-Hat Claims
A day later on September 7, the attacker returned 3,400 BTC to the network, representing about 85% of the drained funds. The partial return came shortly after Blockstream confirmed that bridge nodes had been fully patched. The attacker used this partial return to claim white-hat status. However, the remaining 598.5 BTC worth $47 million was withheld, alongside a ransom demand later shared on social media by Samson Mow, CEO of Jan3 and former CSO of Blockstream.
The perpetrator demanded that Blockstream pay a 10% bounty out of its own corporate treasury. If rejected, the hacker threatened that Liquid asset holders would be forced to absorb a 15% loss. Blockstream responded by calling the tactic outright theft rather than responsible disclosure.
The company maintains it will not pay, arguing that yielding to the demands would set a dangerous precedent. Giving in to extortion risks encouraging third parties to blackmail other open-source developers whenever vulnerabilities in their code are exploited.
Network Freeze and Forensic Tracking
Although Liquid Network has resumed block production following an emergency upgrade, user access remains shut down. Transactions and BTC inflows and outflows on the network are completely frozen.
Blockstream is currently collaborating with law enforcement, crypto exchanges, service providers, and forensic specialists to trace fund movements and identify the attacker. The case underscores a firm line drawn by the developers: refusing to negotiate with hackers, even if the temporary cost involves tens of millions of dollars in community assets.
Reported via crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
