Blockstream Refuses Ransom Demand After Liquid Network Bitcoin Exploit
Blockstream announced it will not pay a ransom for approximately 598.5 BTC remaining under the control of hackers who exploited the Liquid Network, after recovering 3,400 BTC. The company said it will escalate the case to law enforcement if the stolen funds are not returned.
Written by CoinArticle’s AI Newsroom · from 4 cited sources. How we work
Story Updates
- Updated Sep 11, 2026, 07:02 PM: Blockstream says it will escalate case to law enforcement if stolen BTC are not returned; stolen amount now valued at $47 million.
- Updated Sep 11, 2026, 04:01 PM: Liquid transactions resumed with peg-outs temporarily disabled following the ransom rejection.
Recovery and Ransom Rejection
Blockstream confirmed recovery of 3,400 BTC from the Liquid Network exploit on September 8, leaving attackers in control of roughly 598.5 BTC—worth approximately $47 million at current prices. The company announced via social media that it will not pay the outstanding ransom demand for the remaining stolen funds, characterizing the theft as extortion and stating it will report the incident to law enforcement should the funds not be voluntarily returned.
Network Operations Resume
Following the recovery and ransom announcement, transactions on Liquid resumed with peg-outs—transfers of Bitcoin from Liquid back to the main chain—temporarily disabled. The suspension of peg-outs is a precautionary measure to prevent attackers from converting stolen Bitcoin across chain boundaries during the active incident response phase.
Industry Signal Against Extortion
Blockstream's refusal to negotiate signals an industry position against rewarding cybercriminals for theft or extortion. By declining to pay and alerting authorities, the company avoids establishing a precedent that ransom demands tied to cryptocurrency exploits merit payment—a stance that security researchers argue could deter similar extortion tactics against other infrastructure operators in the future.
Why It Matters
For Traders
Peg-out suspension prevents immediate large-scale liquidation of stolen Bitcoin but introduces temporary friction for users withdrawing to mainnet; watch for when transfers resume.
For Investors
A major infrastructure provider's public law-enforcement escalation and ransom refusal sets a defensive precedent that may reduce attacker profitability if other operators follow suit.
For Builders
Sidechain operators face renewed pressure to implement multi-sig custody and incident response protocols; federated models are now under heightened scrutiny for custody and extortion resistance.
This article is for information only and is not financial advice. Read the full disclaimer.
