Blockstream Demands Return of Remaining Stolen Bitcoin

Blockstream, a Bitcoin infrastructure company, has decided against additional negotiations with the attackers responsible for stealing 4,000 bitcoins from its Liquid sidechain last week.

On Friday, Blockstream posted on X that the deadline for returning the stolen funds was still open, after which the company would involve law enforcement.

Last Sunday, individuals claiming to be white-hat hackers removed approximately $320 million from the federation wallet underpinning Blockstream's Liquid sidechain. Following discussions with Blockstream, the bulk of the assets were returned; however, 598.5 bitcoins valued at more than $46 million were retained and demanded as a ransom.

The firm's message stated: "Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft."

To those responsible for the theft of bitcoin from the Liquid Network:

Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is…

— Blockstream (@Blockstream) September 11, 2026

In a follow-up statement, Blockstream said: "We will work with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible."

The company added: "We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds."

Blockstream's sidechain Liquid (also known as L-BTC) is a layer-2 solution enabling swift transfers of assets that are pegged 1:1 to bitcoin. One such asset is LBTC, a token redeemable for bitcoin that facilitates rapid settlement, functioning similarly to the Lightning Network.

The attackers accessed the funds by taking advantage of an inflation flaw within the Liquid sidechain, generating over 4,000 LBTC tokens that had no backing and then exchanging them for genuine on-chain bitcoin.

After the exploit, the hackers communicated with Blockstream by embedding messages directly into Bitcoin blocks.

In an early message, the group claiming to be white-hat hackers wrote: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix."

Their most recent post labeled Blockstream as "delusional, greedy, and arrogant," and included a threat to publicize all encrypted communications from the exchange unless the firm permitted the thieves to retain 10% of the bitcoin.

The message stated: "You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess."

The broader Bitcoin ecosystem continues to feel the impact of a July incident when attackers made off with more than 1,800 bitcoins, valued at nearly $140 million, from Coldcard hardware wallet users.

Coldcard wallet owners were compromised because the device's manufacturer, Coinkite, omitted a genuine random number generator, which enabled attackers to approximate investors' seed phrases.