Rows of Bitcoin mining computers representing infrastructure security

Blockstream Refuses Ransom Demand as Nearly 600 Bitcoin Remain Missing

By Isaac • September 11, 2026 7:10 am • Comments

Blockstream has drawn a hard line in the fight over nearly 600 bitcoin that remain in the hands of the actors behind the Liquid Network exploit.

In a public statement Friday, the Bitcoin infrastructure company said it would not pay a ransom for the return of the funds. Blockstream also rejected the idea that taking assets without permission and withholding them could qualify as responsible security disclosure.

The message marks a sharper turn in an incident that began on September 6. According to a detailed report from SideSwap, a consensus bug in the Elements software beneath Liquid allowed an attacker to create roughly 4,000 L-BTC without a matching Bitcoin deposit.

Trending: XRP Healthcare Winds Down After Wallet Flaw Drains 4,011 Accounts

The newly created L-BTC was sent into SideSwap’s peg-out service and burned as part of what the system treated as an ordinary withdrawal. The Liquid Federation then released about 3,996 BTC, and SideSwap automatically forwarded nearly all of it to the attacker’s address.

SideSwap said none of its wallets or private keys were compromised. But the company accepted responsibility for operational choices that made the loss possible: keeping its peg-out authorization key online, automatically forwarding payouts, and failing to impose basic size, velocity, or wallet-history checks on an extraordinary withdrawal.

Those details matter because this was not a conventional exchange-account breach. The failure crossed layers.

A software flaw created unbacked L-BTC, while weak operational controls allowed that synthetic balance to trigger a real Bitcoin payment.

After Blockstream patched affected bridge nodes, the actors returned about 3,400 BTC. The Block reported that roughly 598.5 BTC remained at the attacker-controlled address following the partial return.

Former Blockstream executive Samson Mow has documented the unusual on-chain negotiations, including signed and encrypted messages exchanged during the recovery effort.

Blockstream’s new position removes any ambiguity over whether the remaining coins are being treated as a negotiated bounty. The company says they are stolen funds and has told the actors to return them in full.

The dispute also leaves the Liquid ecosystem with a serious credibility test. A Bitcoin sidechain built around federated custody must convince users that both its software and its human-controlled safeguards can withstand an abnormal transaction before real reserves leave the system.

SideSwap says it will not resume peg-ins or peg-outs until it and the federation are confident in a new security design. Its proposed review includes how authorization keys are held and what limits must stand in front of a payout.

The partial recovery is meaningful, but it is not resolution. Nearly 600 BTC is still a major sum, and the episode exposed how a single technical vulnerability can become much more damaging when automated systems lack a human stop point.

For Bitcoin holders, the distinction is important: the Bitcoin network itself was not compromised. The incident involved the reserves and software supporting Liquid’s L-BTC system.

Still, the size of the withdrawal makes this one of the most consequential Bitcoin-infrastructure failures of the year. Blockstream has now made clear it will not close the gap by paying the people who created it.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews