Bitcoin infrastructure firm Blockstream has refused to pay a ransom to hackers who stole 4,000 bitcoins from its Liquid network. The company stated it will work with law enforcement and other parties to trace and recover the assets, rejecting the hackers' claim of "white-hat activity."
The incident highlights ongoing security challenges in the cryptocurrency space and the differing philosophies on handling hacks, with Blockstream taking a firm stance against paying ransoms, potentially impacting user confidence and the recovery of stolen assets.
Blockstream, the company behind the Liquid sidechain, has publicly stated it will not pay a ransom to hackers who stole approximately 4,000 bitcoins. The firm, writing on X on Friday, September 11, 2026, indicated that the perpetrators still have time to return the funds before Blockstream engages fully with law enforcement agencies.
Earlier on Sunday, individuals identified as white-hat hackers reportedly withdrew about $320 million from the federation wallet that supports Liquid. Following negotiations with Blockstream, most of the funds were returned, but the hackers retained 598.5 bitcoins, valued at over $46 million, demanding it as ransom. Blockstream explicitly rejected this, calling the action "theft" and not "responsible disclosure" or "white-hat activity."
The company announced its intention to work with law enforcement, exchanges, service providers, and forensic specialists to trace and recover the stolen assets and identify those responsible. Blockstream emphasized its commitment to its users and the broader Bitcoin community, stating they would not abandon the pursuit of the funds.
The theft occurred due to an exploit of an inflation bug on the Liquid sidechain, which allowed hackers to create over 4,000 LBTC (tokens backed 1:1 with bitcoin) that did not previously exist. These newly created tokens were then cashed out for actual bitcoins on the main chain. The hackers and Blockstream reportedly exchanged messages written into Bitcoin blocks, with the hackers urging Blockstream to fix the bug first and later threatening to release encrypted messages if their ransom demand was not met.