Blockstream Refuses Ransom Demand After 85% of Stolen Liquid BTC Is Returned

Blockstream has rejected a ransom demand to recover bitcoin stolen from the Liquid Network after the attacker returned about 3,400 BTC, representing roughly 85% of the stolen funds. Around 598.5 BTC remains outstanding.

The development was highlighted by @WuBlockchain Blockstream said it does not consider the unauthorized removal and withholding of the remaining bitcoin to be white-hat activity, arguing that the assets were stolen and should be returned without payment.

Blockstream Rejects Ransom for Remaining Bitcoin

The attacker previously returned the majority of the stolen funds, leaving a substantial balance still unrecovered. Despite the partial return, Blockstream has taken a firm position against paying a ransom for the remaining bitcoin.

The company said it will instead pursue lawful recovery efforts if the outstanding funds are not returned. Those efforts could involve law enforcement, cryptocurrency exchanges and forensic specialists working to trace and recover the remaining assets.

The distinction between unauthorized asset removal and legitimate security research is central to the dispute. Blockstream's position is that retaining the remaining bitcoin does not qualify as a white-hat recovery arrangement simply because most of the funds have already been returned.

SlowMist Founder Questions Blockstream's Position

SlowMist founder Cos described Blockstream's response as “puzzling,” while also acknowledging that communications between the company and the attacker may contain markets information that has not been publicly disclosed.

That uncertainty leaves open questions about the circumstances surrounding the partial return and the demand for payment. Without details of any private communications between the parties, the public record does not establish why approximately 85% of the stolen bitcoin was returned while 598.5 BTC remains outstanding.

The case also illustrates the challenges facing cryptocurrency companies when stolen digital assets move across multiple addresses and potentially interact with exchanges or other services. Recovery can require cooperation between blockchain investigators, law enforcement and trading platforms rather than relying solely on direct negotiations with an attacker.

Blockstream's next stated course of action is therefore centered on lawful recovery rather than a ransom payment. The key unresolved issue is whether the remaining 598.5 BTC will be returned voluntarily or whether investigators and exchanges will be required to pursue recovery efforts.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.