Blockstream refused to transfer a ransom to the attackers for the 600 $BTC that remained with them after the attack on the Liquid Network — a federated sidechain for Bitcoin. The company characterized the incident not as a vulnerability disclosure, but as theft, and warned that it would seek to recover the funds through law enforcement, exchanges, service providers, and blockchain investigation specialists.
The incident is related to a September exploit: alleged "white hat hackers" withdrew about 4,000 $BTC from the Liquid Network federation's reserves. At the market valuation at the time of the attack, this amounted to approximately $320 million. Later, most of the funds were returned, but about 600 $BTC, or roughly $47 million, remains under the attackers' control.
Blockstream Considers Holding Funds as Theft
Blockstream's stance is firm: the company does not intend to pay for the return of the assets. In its assessment, the unauthorized withdrawal of funds and subsequent retention of a portion of the sum cannot be considered responsible security disclosure.
"Seizing assets without permission and withholding their return is a crime, not responsible disclosure. This is not white-hat activity," stated Blockstream.
After the attack, the operation of the Liquid Network was suspended. If the remaining coins are not returned, Blockstream plans to employ all legal tools: cooperation with law enforcement agencies, cryptocurrency exchanges, service providers, and on-chain forensics experts.
The investigative possibilities here rely on two key features of Bitcoin:
- the movement of funds in the Bitcoin network can be tracked;
- traces in the blockchain do not disappear.
The transparency of blockchain transactions aids in investigating thefts: every transfer leaves a visible trace.
How the Liquid Exploit Worked
According to Chainalysis, the attackers exploited a vulnerability in the mechanism Liquid used to cache transaction confirmation verifications. This allowed them to create unbacked L-$BTC and then exchange them for real Bitcoin.
When Blockstream confirmed the fixes to the bridge nodes, the perpetrators sent back 3,400 $BTC in a single transaction. This is about 85% of the total withdrawn amount. The non-returned portion was sent as change to an address controlled by the attackers.
Some observers suggested that the withheld 600 $BTC might have been considered a de facto bounty for the discovered vulnerability. However, neither Blockstream nor the other party confirmed the existence of such an arrangement.
Why This Story Matters for the Market
The situation remains open. Blockstream indicated that room for responsible settlement still exists but simultaneously emphasized that the public nature of Bitcoin complicates attempts to conceal stolen assets. Any transfer leaves a trail, meaning the funds could come under constant surveillance by analysts and monitoring services.
For the cryptocurrency industry, this case has been a painful reminder of several weak points at once:
- the risks of federated custody models;
- the risks of bridge infrastructure;
- the need for constant security audits even for specialized solutions.
Liquid was created as a technology for fast Bitcoin settlements, but the attack demonstrated that technical specialization alone does not protect against vulnerabilities.
A separate question is how such incidents impact users and services utilizing Cryptocurrency wallets for storing or moving assets. As long as the 600 $BTC are not returned, the conflict between Blockstream and the attackers remains unresolved, and any further movement of the funds will be closely watched by the market.
end-content
