Bitcoin infrastructure enterprise Blockstream has declined to pursue further negotiations with the perpetrators who recently absconded with 4,000 bitcoins from its Liquid network.
In a Friday statement published on X, Blockstream indicated that the individuals still had an opportunity to give back the capital prior to the organization engaging law enforcement.
White-hat actors pulled roughly $320 million from the federation wallet supporting Liquid—a sidechain developed by Blockstream—on Sunday. Following discussions with Blockstream, they sent back the majority of the capital while retaining 598.5 coins valued at in excess of $46 million, which they demanded as a ransom.
“Blockstream will not pay a ransom for the return of stolen funds,” the update stated. “Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.”
The company further noted: “We will work with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible.”
“We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds.”
Liquid, or L-BTC, functions as a layer-2 protocol established by Blockstream enabling users to swiftly transfer assets backed on a 1:1 ratio with bitcoin. LBTC serves as a bitcoin-backed token that facilitates rapid settlement, functioning somewhat similarly to the Lightning Network.
The culprits acquired the funds by exploiting an inflation vulnerability within the Liquid sidechain, generating upwards of 4,000 unbacked LBTC tokens and subsequently liquidating them for genuine, on-chain bitcoins.
The actors subsequently communicated with Blockstream via on-chain messages inscribed directly into Bitcoin blocks.
One message from the white hats stated: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
In their most recent transmission, the hackers labeled Blockstream as “delusional, greedy, and arrogant,” threatening to expose all encrypted correspondence from the exchange unless the firm permitted the thieves to retain 10% of the bitcoins.
“You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess,” the message asserted.
The broader Bitcoin ecosystem continues to recover from a separate July incident wherein malicious actors stole in excess of 1,800 bitcoins—valued near $140 million—from Coldcard wallet owners.
Clients utilizing the widely adopted hardware wallet, produced by Coinkite, were compromised because the device manufacturer omitted a genuine random number generator, enabling outsiders to deduce user seed phrases.
What happened to the Liquid network?
Hackers exploited an inflation bug on the Liquid sidechain to create over 4,000 unbacked LBTC tokens, cashing them out for real on-chain bitcoins, totaling a theft of 4,000 bitcoins.
Did Blockstream pay the ransom?
No, Blockstream refused to pay a ransom, stating that taking assets and withholding their return is theft rather than responsible disclosure.
How much of the stolen bitcoin is still missing?
The hackers returned most of the funds after negotiating with Blockstream, but they kept 598.5 coins worth over $46 million.
What is the Liquid network?
Liquid (L-BTC) is a layer-2 sidechain created by Blockstream that enables users to rapidly move assets backed 1:1 with bitcoin for quick settlement.
