Blockstream Rejects 60-BTC Ransom Demand as 598.5 BTC Remains Missing From Liquid Exploit

Frank Joaquin

Date: September 12, 2026

Blockstream has rejected a demand for roughly 60 BTC from the actors responsible for exploiting the Liquid Network, drawing a hard line after most—but not all—of the Bitcoin removed during the incident was returned.

Approximately 598.5 BTC remains under the actors’ control, worth roughly $47 million at recent Bitcoin prices. Blockstream said it would not pay for the return of those funds and rejected the characterization of the incident as responsible white-hat disclosure. According to The Block’s reporting on Blockstream’s response, the company said it was prepared to work with law enforcement, exchanges and blockchain-forensics specialists if the remaining Bitcoin was not returned.

The confrontation follows one of the largest Bitcoin-related security incidents of the year. Reuters reported that roughly 4,000 of the approximately 4,200 BTC held in Liquid’s federation wallet were withdrawn during the September 6 incident. The Bitcoin was valued at approximately $320 million at the time.

The attack did not involve breaking Bitcoin itself. Instead, investigators traced the problem to Elements, the software underlying Liquid. According to Chainalysis’ technical analysis, a flaw involving cached cryptographic verification results allowed invalid transaction data to be treated as though it had already passed verification. That ultimately enabled the creation of unbacked L-BTC without the corresponding Bitcoin that should normally support it.

The actors then converted that unbacked L-BTC into real Bitcoin through Liquid’s peg-out infrastructure. SideSwap said approximately 4,000 L-BTC was sent through its peg-out service and burned using a valid authorization, after which the Liquid Federation released approximately 3,996 BTC. SideSwap maintained that neither its systems nor its peg-out authorization key had been compromised.

Communication between Blockstream and the actors subsequently occurred through messages embedded in Bitcoin transactions. After Blockstream indicated that its bridge nodes had been patched, the actors returned 3,400 BTC in a single transaction, representing roughly 85% of the Bitcoin originally withdrawn. Approximately 598.5 BTC remained at an actor-controlled address.

The dispute then shifted from vulnerability disclosure to compensation. The actors sought approximately 10% of the remaining funds—about 60 BTC—as a bounty for returning the rest. Blockstream refused. Decrypt independently reported that the company said taking assets without authorization and withholding their return did not qualify as white-hat activity. The remaining 598.5 BTC had not moved as of the latest reporting.

Blockstream and Liquid have also moved to repair the technical vulnerability. The official Elements GitHub release page shows Elements version 23.3.4 released September 9. Among its listed changes is a security modification that hardens range-proof cache keys and adds an option to disable the range-proof cache.

Liquid has since resumed transactions, but peg-outs remain disabled while recovery work continues and the network works to restore the relationship between its Bitcoin reserves and circulating L-BTC.

The incident has also created a secondary security threat. Blockstream issued an official phishing warning after scammers began impersonating Liquid, Blockstream and support personnel. The company warned users not to respond to unsolicited messages claiming that funds must be moved, wallets updated or recovery phrases entered because of the Liquid incident.

TOKEN RECON ASSESSMENT

The 598.5 BTC still outstanding is the immediate financial problem, but it is not the most important intelligence from this incident.

The deeper issue is the failure of validation between token creation and Bitcoin redemption.

Bitcoin itself was not compromised.

Instead, a vulnerability in infrastructure built around Bitcoin allowed unbacked L-BTC to be accepted as valid and ultimately exchanged for real BTC held in reserve.

That distinction matters.

Sidechains, bridges, wrapped assets and tokenized representations can inherit Bitcoin’s settlement layer while simultaneously introducing entirely new attack surfaces above it. The security of the underlying blockchain does not automatically guarantee the security of every financial system built around it.

The return of approximately 3,400 BTC substantially reduced the financial damage, but it does not erase the vulnerability that made the withdrawal possible.

Token Recon is now watching five things:

The remaining 598.5 BTC.

Any movement from the actor-controlled addresses could trigger exchange and blockchain-forensics monitoring.

Restoration of Liquid peg-outs.

Resuming peg-outs will be an important indication that operators believe the reserve and validation system can safely process withdrawals again.

Independent review of Elements 23.3.4.

The patch addresses the range-proof cache vulnerability, but additional technical review will be important before the incident can be considered fully contained.

The restored BTC-to-LBTC reserve relationship.

Liquid depends on confidence that L-BTC remains properly backed by Bitcoin. Restoring and demonstrating that relationship is essential.

Post-exploit phishing activity.

Security incidents frequently create a second attack wave as criminals impersonate affected companies and target users who are already concerned about their funds.

The broader lesson for Crypto Scouts is clear:

Bitcoin security and Bitcoin-infrastructure security are not the same thing.

The Bitcoin network did not fail.

A financial layer built around Bitcoin did.

As more capital moves through sidechains, bridges, tokenized Bitcoin products and cross-chain settlement systems, the validation mechanisms connecting those systems to real BTC become increasingly important attack surfaces.

For Liquid, the battlefield now moves from emergency recovery to proving that the vulnerability has been fully contained—and that the remaining 598.5 BTC can either be recovered or prevented from re-entering the market unnoticed.