- Blockstream said it would not pay a ransom to recover about 598.5 BTC still controlled by the party involved in the September 6 Liquid Network incident, after 3,400 BTC was returned.
- The remaining bitcoin was valued at roughly $47 million, and Blockstream said it would involve law enforcement and industry partners if the funds were not returned voluntarily.
- A party calling itself white hats had demanded a reward equal to 10% of the withdrawn amount.
Blockstream said it would not pay a ransom to recover the remaining bitcoin withdrawn in the Liquid Network incident. The company published the statement on X.
“Taking assets without permission and refusing to return them is a crime, not responsible vulnerability disclosure. This is not white hat activity [so-called ethical hackers]. This is theft,” Blockstream said.
Reward demand and Blockstream’s response
Blockstream said it negotiated “in good faith” with those involved in the incident because it expected to recover users’ funds, but the company said it would not agree to their demands.
A party describing itself as white hats had demanded a reward equal to 10% of the withdrawn amount, according to previously published correspondence. The party sought payment from Blockstream’s own funds and said Liquid Network asset holders could otherwise have faced losses of around 15%.
If the remaining funds are not returned voluntarily, Blockstream said it intends to work with law enforcement, cryptocurrency exchanges, service providers and blockchain forensics specialists. The company said Bitcoin transactions are public, leaving incident-related transactions and evidence preserved on the blockchain.
Liquid Network incident and recovery
About 4,000 BTC, worth roughly $320 million, was withdrawn from the Liquid Network’s reserves on September 6. A vulnerability in the Elements software made it possible to create around 4,000 L-BTC without corresponding bitcoin backing, according to the source article. Those tokens were then used to withdraw real bitcoin through the SideSwap service.
After the vulnerability was fixed, the party controlling the funds returned 3,400 BTC. About 598.5 BTC, valued at roughly $47 million, remained at an address linked to the party.
Most of the funds were returned after Blockstream confirmed that patches had been deployed on network nodes.
The Liquid Network temporarily halted operations following the incident. On September 10, it began a phased recovery and resumed block production after deploying an emergency update, although Bitcoin deposits and withdrawals remained suspended for some time.
Source: Incrypted
