Blockstream Tells Hackers To Return Remaining Bitcoin Stolen in Liquid Theft
Bitcoin Magazine Blockstream Tells Hackers To Return Remaining Bitcoin Stolen in Liquid Theft White hat hackers targeted Blocksteam's Liquid sidechain, taking over 4,000 bitcoins. They want to keep s...
White hat hackers targeted Blocksteam's Liquid sidechain, taking over 4,000 bitcoins. They want to keep some of the bitcoins as a reward. Blockstream isn't happy.
Bitcoin infrastructure firm Blockstream has refused to negotiate further with hackers who last week stole 4,000 bitcoins from its Liquid network.
Writing on X Friday, Blockstream said that the hackers still had time to return the funds before the company would work with law enforcement.
White-hat hackers on Sunday withdrew about $320 million from the federation wallet that backs Liquid, a sidechain by Blockstream. After negotiating with Blockstream, they returned most of the funds but kept 598.5 coins worth over $46 million — demanding it as ransom.
“Blockstream will not pay a ransom for the return of stolen funds,” the post read. “Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.”
To those responsible for the theft of bitcoin from the Liquid Network:Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is…
It added: “We will work with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible.”
“We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds.”
Liquid, or L-BTC, is a layer-2 created by Blockstream that allows users to fast move assets backed 1:1 with bitcoin. One of the assets, LBTC, is a token backed by bitcoin that allows for quick settlement — a bit like the Lightning Network.
Hackers were able to get the funds by exploiting an inflation bug on the Liquid sidechain to create over 4,000 LBTC that did not exist before and cash them out for real, on-chain bitcoins.
The hackers then had an exchange with Blockstream via messages written into Bitcoin blocks.
In one message, the white hats wrote: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
In the latest message, the hackers slammed Blocksteam as “delusional, greedy, and arrogant,” and threatened to reveal all of Blockstream’s encrypted messages in the exchange unless the company allowed thieves to keep 10% of the bitcoins.
“You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess,” the message read.
The Bitcoin community is still reeling after hackers in July were able to steal over 1,800 bitcoins worth close to $140 million from Coldcard wallet holders.
Users of the popular hardware wallet, created by Coinkite, were targeted because the product’s manufacturer did not use a true random number generator, allowing hackers to essentially guess investor seedphrases.
Asanat Analysis — Why it matters
Liquid's $320M breach exposes a critical vulnerability in Blockstream's sidechain architecture: a bug allowing inflation of L-BTC tokens that could be arbitraged for real bitcoins. This isn't merely an operational failure—it signals that even established Bitcoin infrastructure projects can harbor undetected logic flaws in token backing mechanisms. The attackers' ability to exploit and partially recover funds while negotiating via blockchain messages underscores how transparent on-chain systems create asymmetric leverage: Blockstream must respond publicly, while attackers maintain anonymity.
The ransom demand frames a broader ecosystem problem. 'White-hat' extortion—claiming responsible disclosure while withholding stolen funds—blurs the line between bug bounty and theft, pressuring companies to pay or face reputational damage and user losses. Blockstream's refusal to negotiate sets a precedent, but raises the stakes: unresolved theft can trigger confidence erosion in Liquid's security model, particularly for institutions relying on sidechain finality. This follows the July Coldcard RNG failure, suggesting a pattern of fundamental cryptographic/protocol assumptions breaking under scrutiny.
The incident has second-order implications for Layer 2 trust models more broadly. Sidechains like Liquid depend on federation assumptions (multi-sig authority), and this breach proves those assumptions can be compromised at the application layer. Users must recalibrate risk assessment: technical elegance of fast settlement doesn't offset operational risk if core tokenomics can be inflated. Recovery efforts via law enforcement and exchange freezes face the known problem of tracing coins post-mixing, making actual fund recovery unlikely.