Blockstream is reported to have refused a ransom demand tied to the remaining 600 BTC from a Liquid exploit, responding to the attacker with a call to return the bitcoin. That reported refusa
Blockstream is reported to have refused a ransom demand tied to the remaining 600 BTC from a Liquid exploit, responding to the attacker with a call to return the bitcoin. That reported refusal sits on top of a security incident Blockstream has publicly documented, in which purported white-hat hackers withdrew roughly 4,000 BTC from the Liquid Federation wallet.
According to a single news report that could not be independently verified, Blockstream rejected a ransom demand covering the outstanding 600 BTC and told the exploiter to return the funds. No original statement, speaker, date, or communication channel for that response has been confirmed, and the phrase in the headline should not be read as a documented direct quotation.
What Blockstream has stated on the record is narrower. Its official Liquid security incident report describes an initial withdrawal of approximately 4,000 BTC, valued at around $320 million, from the Liquid Federation wallet, attributed to purported white-hat hackers. Blockstream frames this as an initial estimate, not an independently reconciled final loss.
Liquid incident: initial withdrawal estimate
≈4,000 BTC
Blockstream’s initial incident report estimates approximately 4,000 BTC was withdrawn from the Liquid Federation wallet. This is an attributed initial estimate, not an independently reconciled final loss or the amount still outstanding. Source: Blockstream.The same report says the withdrawal used the SideSwap Peg-out Authorization Key, while stating that this key and other keys were not compromised. Blockstream also said exchanges were notified and had paused, or would pause, LBTC deposits and withdrawals, an account of the industry response rather than an independently confirmed exchange statement.
The 600 BTC in the headline is described as the amount still held by the exploiter, not the total taken. It should not be equated with either the full withdrawal or with any ransom sum, and no reconciliation of what was taken, returned, and still outstanding has been published in the evidence available.
No dollar conversion is offered here because no valuation timestamp accompanies the reported 600 BTC figure. Bitcoin traded near its current level while the incident played out, but no incident-driven market reaction has been demonstrated.
Blockstream's own recovery guidance points to a live phishing risk. Its September 9, 2026 phishing alert warns that impersonators are posing as Liquid, Blockstream, and support staff following the incident. It states plainly that the incident does not require users to move funds, enter recovery phrases, re-peg assets, check reimbursements, or install software sent by email.
Operationally, the network is partly back online. The live Liquid homepage notice says issued-asset transfers have resumed while LBTC transfers and peg-out operations remain paused. Blockstream's status bulletin dated September 10, 2026, 10:00 UTC separately said the required functionary and bridge node updates had been deployed and functionary nodes were signing and validating blocks.
The central claims of the headline, the 600 BTC remainder, the ransom demand, and Blockstream's refusal, are not established by any of these official pages. Until Blockstream publishes the negotiation directly or authenticates the attacker's messages, the exploit's scope and the fate of the remaining funds stay open questions.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on tokentopnews.com
