Blockstream said it will not pay a ransom for the roughly 600 BTC still missing after the Liquid exploit, marking a firm stance in one of 2026’s most closely watched security incidents.
The refusal was reported on September 11, 2026, when Blockstream said it would not meet a demand tied to the stolen Bitcoin, according to reporting by crypto.news. The Liquid Network is a Bitcoin sidechain, a separate blockchain linked to the main Bitcoin network. For related coverage, see Bitcoin Suisse Plans to Cut Up to 60 Swiss Jobs.
Here is what matters most, explained in plain terms for anyone holding a little Bitcoin.
Key Takeaways
- Blockstream reportedly refused a ransom demand for the Bitcoin still missing after the Liquid exploit.
- The headline figure of roughly 600 BTC is a rounded amount; reporting puts it at about 598.5 BTC.
- No independently verified recovery of the remaining Bitcoin has been confirmed in the available evidence.
Blockstream refuses the reported ransom demand
Blockstream, the company behind the Liquid Network, said it would not pay to get the missing Bitcoin back. The refusal was published in a September 11 statement and corroborated by separate reporting from Unchained. For related coverage, see Adam Back-Backed BSTR Bitcoin Treasury Merger Ends With $15M Cash Obligation.
Unchained reported that the attackers demanded a fee equal to 10% of the 4,000 BTC taken, and that Blockstream rejected it. Blockstream also pushed back on any “white-hat” framing, the label sometimes used when a hacker returns funds for a reward.
The headline phrase “Return the bitcoin” has been attributed to Blockstream through reporting that quotes its post. According to unconfirmed reports, that exact wording appears in the company’s original statement on X, but the original post was not independently verified here.
Blockstream said it plans to work with law enforcement, exchanges, service providers and forensic specialists if the funds are not returned. No named agency, case number or court filing has been confirmed.
What the remaining 600 BTC refers to
The “remaining” 600 BTC is the portion still outstanding after some funds came back. Reporting puts the outstanding amount at approximately 598.5 BTC, so 600 is a rounded figure, not an exact wallet balance.
Bitcoin still outstanding
Approximately 598.5 BTC
Crypto.news reported that 3,400 BTC was returned to the Liquid federation wallet on September 7, 2026. The federation is the group of businesses that jointly manage the network.
Bitcoin returned
3,400 BTC
The trouble began with a software flaw. SideSwap, a Liquid-based exchange, said a consensus bug in Elements, the software behind Liquid, let someone create unbacked L-BTC on September 6, 2026. L-BTC is the Liquid version of Bitcoin, meant to be backed one-to-one by real BTC.
That fake money was then cashed out. SideSwap identified an unbalanced mint transaction at Liquid block 4,050,336 at 13:53 UTC, and said federation signers released 3,996.02 BTC roughly half an hour later. Its service forwarded almost all of that, 3,995.99999857 BTC, to the attacker in the same block.
Nearly 4,000 BTC left the system in one move. Our earlier coverage detailed the initial Liquid federation Bitcoin withdrawal as the incident first surfaced.
SideSwap admitted its payout design failed. It said its authorization key was online, payouts were automatic, and its pipeline lacked checks on order size, rate, velocity, supply and wallet age. It also found 70 balanced rehearsal transactions before the single unbalanced mint, though it cautioned that earlier wallets cannot all be tied to the attacker.
For context on scale, Bitcoin traded near $77,277 during this research window, down about 0.8% on the day. That is general market context, not a price move caused by the exploit.
What remains unclear about recovering the bitcoin
Refusing a ransom is not the same as getting the money back. The available evidence confirms the refusal but shows no verified recovery of the outstanding coins, and no deadline or official recovery plan has been published.
Operations were also disrupted. Unchained reported that peg operations, the process for moving Bitcoin in and out of Liquid, were suspended at its reporting time. SideSwap has since said markets reopened while L-BTC redemptions stayed paused, so status can change quickly.
Users faced a second risk: scams. Blockstream warned on September 9 that impersonators were exploiting the incident. It said it would never ask users to move funds, enter recovery phrases, re-peg assets or install software sent by email.
If you hold Bitcoin on an exchange or in your own wallet, this event does not touch your coins. Watch official channels for updates, and treat any message asking for your recovery phrase as a scam, no matter who it claims to be from. The pattern echoes how token custody shaped outcomes in the NES recovery after its exploit.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
