Blockstream Rejects $50 Million Liquid Ransom Demand and Backs the Bitcoin Peg

Blockstream is drawing a hard line after one of the strangest recoveries the crypto industry has seen: most of the Bitcoin taken from the Liquid Network came back, but the company is refusing the attacker’s demand for nearly 600 BTC — roughly $50 million — as a reward for returning it.

The dispute grew out of a September 6 exploit involving Liquid, Blockstream’s Bitcoin sidechain. According to a detailed CryptoSlate review of the incident and the onchain messages, the attacker exploited a vulnerability to create about 4,000 unbacked L-BTC and withdrew approximately 3,996 real BTC through SideSwap.

After Blockstream patched affected nodes, roughly 3,400 BTC was returned. That is an extraordinary recovery by crypto-hack standards. It also left a shortfall of close to 600 BTC and set up a fight over whether returning most of stolen funds gives the attacker any legitimate claim to a giant “bounty.”

Blockstream says users will not eat the shortfall.

The most important point for Liquid users is not the rhetoric between Blockstream and the attacker. It is the backing behind L-BTC.

Blockstream CEO Adam Back told users that the one-to-one L-BTC-to-BTC peg would be covered. He urged holders not to panic-sell while engineers worked through the staged network recovery.

@liquid_btc network resumption coming up.
obvious question will LBTC:BTC 1:1 peg be covered; answer YES, so do not panic sell OTC as @PabloSGreco and team are working on more system updates to resume the peg in/out, which happens in a later step. https://t.co/eQAVbQKNi3

— Adam Back (@adam3us) September 10, 2026

Trading can restart before every normal bridge function is restored, but holders ultimately need confidence that each unit of L-BTC can again be redeemed for one BTC. A promise to cover the gap transfers the immediate financial risk away from users and onto Blockstream’s recovery plan.

A rare recovery has turned into a ransom argument.

The attacker reportedly argued that returning about 85% of the Bitcoin justified a 10% payout from Blockstream’s own funds. Blockstream rejected that framing.

Paying such a demand could encourage future attackers to steal first and negotiate later. The requested “bounty” is tens of millions of dollars, not a normal bug-bounty award.

There is an uncomfortable counterargument: crypto protocols almost never recover this much from a major exploit, and a hard refusal could make the next attacker less willing to return anything. Security researcher zerolore captured that tension while stressing that the theft itself was not justified.

This is pretty insane.

Never in my life I would have guessed to witness a 4k BTC hack, where 3400 BTC being returned, culminate in a post like this.

I can think of at least 5 protocols hit by DPRK that would give everything they have to be in the situation blockstream is right…

— zerolore (@zerolore) September 11, 2026

Now the peg has to prove itself.

Blockstream must restore normal peg-in and peg-out operations and account for the remaining reserve gap. The one-to-one promise has to hold under withdrawal pressure.

Blockstream is wagering that absorbing or recovering the remaining shortfall is better for Liquid’s credibility than handing nearly 600 BTC to the attacker. If the peg returns cleanly and holders are made whole, the company can argue that it protected users without turning extortion into a business model.

If delays drag on or the reserve plan proves unclear, the attacker’s threat will continue hanging over the network. The return of 3,400 BTC has prevented a much worse outcome.

The last 600 BTC will determine whether Liquid’s recovery becomes a security success story or an expensive lesson in how difficult it is to negotiate after a decentralized exploit.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.