The Bitcoin infrastructure company said on September 11 that it had engaged with those responsible in an effort to recover user assets but would not accept their demand for payment. The actors, who described themselves as white-hat hackers, had sought a 10 per cent bounty after returning most of the bitcoin taken from the network.
“Taking assets without authorization and withholding their return is a crime, not responsible disclosure,” Blockstream said. “It is not white-hat activity. It is theft.” The company added that it would not establish a precedent under which open-source developers could be forced to pay a ransom far beyond their economic participation in a network.
About 598.5 BTC remained outstanding when Blockstream issued the statement. The balance was worth roughly $47 million when the standoff emerged, although its dollar value moves with the bitcoin price. Blockstream told the actors to return the funds and said transactions on the Bitcoin blockchain would leave evidence that could assist tracing and recovery efforts.
The dispute followed a September 6 exploit in which about 4,000 BTC, then valued at approximately $320 million, was withdrawn from the Liquid Federation wallet. The amount represented most of the bitcoin reserves backing L-BTC, the token used on Liquid to represent bitcoin transferred to the sidechain.
Blockstream and Liquid said no federation keys were compromised. Investigations instead identified a flaw in Elements, the open-source software underlying Liquid, involving the caching of range-proof verification. The vulnerability allowed invalid confidential transactions to be treated as if their proofs had already been verified, enabling unbacked L-BTC to be created and then redeemed for real bitcoin.
SideSwap, a Liquid Federation member that operates a peg-out service, processed the transaction after receiving approximately 4,000 L-BTC. The tokens were burned through a valid peg-out authorisation process, after which the Liquid Federation released almost 4,000 BTC to the destination address. SideSwap said its systems and peg-out authorisation key were not compromised.
The actors communicated with Blockstream through on-chain messages after the withdrawal. They initially said they would return most of the funds once the vulnerability was fixed. Blockstream later issued a signed message stating that bridge nodes had been patched and that it was safe to return the bitcoin.
About 3,400 BTC was then sent back to the federation wallet on September 7, leaving roughly 598.5 BTC under the actors’ control. The return represented about 85 per cent of the bitcoin withdrawn.
A later on-chain message demanded a 10 per cent bug bounty from Blockstream’s own funds and warned that Liquid holders could otherwise face losses. Blockstream rejected that demand, disputing the attackers’ characterisation of their actions as responsible security research.
The company deployed Elements version 23.3.4 on September 9 as part of its response. Liquid resumed block production on September 10, followed by the restoration of transactions, while peg-outs remained disabled as a precaution during the final phase of recovery.
Blockchain analytics firms examining the exploit have described it as the largest cryptocurrency theft of 2026 so far by dollar value. Their assessments indicate that the incident stemmed from software validation behaviour rather than stolen signing credentials, a distinction that has shaped Blockstream’s effort to restore network operations while pursuing the unrecovered bitcoin.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
