Blockstream has refused to pay for the return of the Bitcoin still missing from the Liquid Network. It can refuse because it has already agreed to cover the shortfall itself.
The actors holding roughly 598.5 BTC demanded a 10% bounty from Blockstream’s own funds, warning that Liquid holders would otherwise face a 15% loss. Chief Executive Adam Back said on Wednesday that the 1:1 LBTC to BTC peg will be covered, which removes the threat the demand rests on.
Blockstream published its position on Friday in a pinned statement addressed to those responsible for the theft, to the Bitcoin community, and to whoever is holding the coins.
What the Company Said
The statement rejects the framing the actors have used since September 6. Taking assets without authorization and withholding their return is a crime rather than responsible disclosure, Blockstream said, adding that it is not white-hat activity but theft.
The company said it had engaged in good faith to secure the return of stolen user funds and protect the broader Bitcoin community and that this effort should not be mistaken for acceptance of the actions taken or the terms being demanded.
On the demand itself, Blockstream said it will not be party to a precedent under which open-source software developed for the Bitcoin community subjects its developers to paying a ransom far exceeding their economic participation. It added that Bitcoin is hard money that cannot be minted without costs and does not charge users to pay a ransom.
The Line That Answers the Threat
That last sentence responds to something specific. The Crypto Times reported on Wednesday that on-chain plaintext from the actors on September 9 demanded Blockstream pay 10% using its own money as a bug bounty, or cause all its holders a 15% loss.
A haircut would mean LBTC holders absorbing the shortfall, with each token backed by less than one Bitcoin. That was the leverage.
It no longer applies. When Liquid restarted block production on September 10, Back stated publicly that the 1:1 peg will be covered. With Blockstream absorbing the gap, the outcome the actors threatened falls on the company rather than on users—which is what makes refusal possible.
What Happens if the Coins Stay Gone
Blockstream told those holding the Bitcoin, there is still an opportunity to resolve the matter responsibly and that the coins can be returned and the parties revert to standard white-hat principles.
Failing that, the company said it will pursue every lawful avenue available, working with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible.
It also made an argument about the medium. Bitcoin is transparent by design, the statement said, and transactions do not disappear—nor does the evidence they leave behind. TRM Labs says it has labelled the attackers’ addresses and continues to track the funds that were not returned.
The Outstanding Amount
About 598.5 BTC, worth roughly $47 million, has not come back. The Crypto Times reported the partial return on September 8, when 3,400 BTC was sent to the federation wallet at 16:09 UTC on September 7, about 85% of what was taken.
The retained amount was not a separate transfer. It is the change from the same transaction, returned to the actor-controlled address. CertiK noted at the time that it could serve as a bounty, though no formal agreement has been publicly confirmed.
SideSwap returned roughly 4 BTC in peg-out fees it had received, bringing the federation wallet to about 3,601.42 BTC.
How It Started
Around 3,998.5 BTC left Liquid’s federation wallet on September 6, from a reserve of roughly 4,200 BTC, valued near $320 million at the time. The Crypto Times reported the pause that day.
No private keys were compromised. A range-proof cache-key flaw in Elements, the open-source software underpinning Liquid, allowed the creation of roughly 4,000 unbacked L-BTC, which were routed through SideSwap’s peg-out service under a valid authorization and converted into real Bitcoin. Elements v23.3.4 was released to harden the cache keys.
Block production resumed on September 10, with peg-in and peg-out operations still suspended. Blockchain analytics firm TRM Labs, which puts the theft at $319 million on its own valuation, has recorded it as the largest crypto theft of 2026, ahead of the April thefts from KelpDAO and Drift. It counts roughly $1.73 billion stolen across 333 incidents this year, a record number of incidents even as the dollar total runs below previous years.
