Liquid recovers 3,400 BTC. Blockstream refuses to pay the ransom for the remaining funds – Bitcoin.pl

• Blockstream categorically rejected the request to pay out a 10% bounty made by people who took over funds from the Liquid network.
• Of the initial amount of approximately 4,000 BTC, the perpetrators returned 3,400 coins, and the company announced legal action to recover the remaining 598 bitcoins.
• Liquid network nodes have been instructed to upgrade to Elements v23.3.4, and transactions and block production have resumed with withdrawals disabled.

Blockstream rejected the request for 10% of the reward presented by the hackers responsible for transferring funds from the Liquid project. The company led by Adam Back stated that holding assets without authorization is outright theft and not responsible disclosure of vulnerabilities. The team identified a loss of approximately 4,000 BTC from the federation wallet on September 6. Although the other party returned 3,400 coins, it still has approximately 598 bitcoins.

The company’s management emphasized that attempts to recover funds amicably do not mean acceptance of extortion. Opposition to bounty payments stems from a desire to avoid a precedent that would burden open-source developers with fees for criminal activities. The official position emphasized that bitcoin is hard money and the costs of acquiring it are clear. For this reason, the network does not intend to burden users with losses to pay the requested ransom.

People holding assets received clear information about the need to return them unconditionally. If this does not happen, the company announces that it will use the full range of legal remedies. The action plan includes the involvement of law enforcement agencies, cryptocurrency exchanges, service providers and investigative analysts. Project representatives recalled that the technical architecture records movements on the blockchain, which makes it impossible to hide traces of capital flow.

The dispute escalated after public statements by the perpetrators, who accused Blockstream of hubris and lack of flexibility. Samson Mow, former head of strategy, responded to these accusations, pointing to the lack of imagination on the part of the attackers. In his opinion, the very fact of establishing PGP-encrypted contact was a gesture of good will on the part of the injured parties, which the other party could not appreciate.

Mow noted that admitting to seizing funds in public space while imposing financial conditions puts the perpetrators in a difficult legal position. He also pointed out that during the funds transfer operation, the attackers left more digital traces on the network than they realised. This data is now evidence for analysts.

After the downtime, Liquid’s infrastructure entered the next stage of restoring functionality. Block production and intra-network transaction execution are operating normally. Only the withdrawal function, the so-called peg-out, remains suspended. Technical teams constantly monitor the system, using tools based on AI agents to verify the code.

Node operators were advised to urgently install the software update to Elements v23.3.4. The implemented fixes are intended to protect the architecture against re-use of the vulnerability in the federation wallet. The withdrawal block will last until external audits are completed and the integrity of the portfolios is fully verified.

The network situation shows the challenges facing Bitcoin’s two-layer solutions. Even though some of the funds were recovered without affecting users’ balances, a tough stance towards bounty demands sets limits in relations with people looking for vulnerabilities in the code. The recovery of the remaining 598 bitcoins now depends on the effectiveness of investigative activities and cooperation with international exchanges.