Blockstream Rejects Ransom Demand as Hackers Hold Nearly 600 BTC

Key Takeaways

• Blockstream rejected the hackers’ demand for a 10% bounty as they retained nearly 600 BTC.
• Hackers returned 3,400 BTC after security fixes, leaving nearly 600 BTC outstanding.
• Liquid has resumed producing empty blocks, but transactions and Bitcoin transfers remain suspended.

Bitcoin infrastructure company Blockstream has refused to pay a ransom to the hackers holding nearly 600 Bitcoin taken from the Liquid Network. The company has warned that it will pursue recovery through law enforcement and blockchain investigations if the funds are not returned.

“Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft,” the company posted on X.

— Blockstream (@Blockstream) Sep 11, 2026

Blockstream said Friday that it had engaged with hackers in good faith to recover users’ assets but would not accept their demand. It also rejected their claim that the incident was a white-hat operation.

In an on-chain message shared Wednesday by Jan3 CEO and former Blockstream chief strategy officer Samson Mow, the hackers demanded that Blockstream pay a 10% bounty from its own funds. They also warned that Liquid holders would otherwise face a 15% loss.

The incident began on September 6, when attackers withdrew about 4,000 BTC from Liquid’s federation wallet. Liquid, a Bitcoin sidechain, paused operations following the withdrawal.

Later, the hackers returned 3,400 BTC after Blockstream confirmed that it had patched the affected bridge nodes. That recovered roughly 85% of the withdrawn Bitcoin, while about 598 BTC remained outstanding.

Liquid resumed block production on Thursday after emergency software updates, but it produced only empty blocks. Transactions and Bitcoin transfers into and out of the network remained suspended, meaning the restart had not restored normal user activity.

Blockstream has urged the hackers to voluntarily return the remaining Bitcoin. Otherwise, it said it would work with law enforcement, exchanges, service providers, and forensic specialists to trace and recover the assets and identify those responsible.

Get started on WEEX with a simple 40 USDT reward. Deposit 100 USDT, make your trade, and claim the bonus. 

Disclaimer: All content on The Moon Show is for informational and educational purposes only. The opinions expressed do not constitute financial advice or recommendations to buy, sell, or trade cryptocurrencies. Trading involves significant risk and may result in substantial losses. Always seek independent financial advice before making investment decisions. The Moon Show is not responsible for any financial losses or decisions made based on the information provided.

Please view the full disclaimer at: https://themoonshow.com/disclaimer