Blockstream has categorically refused to pay any ransom for the approximately 598.5 BTC that remains under control of the actors behind the Liquid Network exploit. In a statement posted on September 11, the company rejected the actors' description of their actions as responsible disclosure or white-hat activity, stating "Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft." The dispute centers on the remaining Bitcoin worth close to $47 million after 3,400 BTC was returned to Liquid's federation wallet on September 7, representing approximately 85% of the total Bitcoin withdrawn. Blockstream argued that paying the demanded 10% bounty would establish a precedent where open-source developers could be forced to fund large payments after unauthorized withdrawals from systems using their software. Ledger Chief Technology Officer Charles Guillemet questioned the white hat claim days earlier, arguing that attackers who empty a bridge and then invite contact are not doing security research.
Liquid Network has resumed block production after a $320 million Bitcoin withdrawal forced the sidechain to halt operations. According to the latest network update, functionary nodes are again producing blocks as intended, but the network will operate without transactions while developers monitor its condition. The limited restart allows Liquid to test its updated infrastructure without reopening transfers or exposing the peg system to new activity. Functionary and bridge nodes have received the required software changes, with functionaries now able to sign and validate blocks, though users cannot yet send regular transactions or move funds between Bitcoin and Liquid. Peg operations also remain suspended, including withdrawals approved through Peg-out Authorization Keys (PAKs), as the network works to restore the reserve that supports Bitcoin issued on the sidechain as L-BTC.
Liquid released an emergency Elements update (version 23.3.4) designed to address the flaw connected to the withdrawal. According to crypto.news, Elements v23.3.4 changes the cache keys used when validating range proofs, which allow the network to confirm that a hidden transaction amount is valid without publicly revealing the amount. The affected software stored successful proof-verification results so nodes could reuse them instead of repeating the full calculation. By exploiting that weakness, the actor created L-BTC without first locking an equal amount of Bitcoin in the federation wallet. Functionary nodes running the affected code accepted the tokens, while SideSwap's peg-out process treated them as valid L-BTC and processed the withdrawal. Liquid said version 23.3.4 hardens the cache keys associated with range proofs, with functionary and bridge nodes receiving the update before block signing restarted. A later examination found that the incident stemmed from a cache-key collision in confidential transaction verification logic, with federation keys remaining secure.
Liquid Network has recovered 3,400 BTC worth about $270 million from the self-described white-hat hackers, representing approximately 85% of the withdrawn funds. As reported by crypto.news, the actors returned the funds to the Liquid Federation wallet after Blockstream sent a signed message stating that its bridge nodes had been patched and the Bitcoin was "safe to return." The recovery process involved communication through Bitcoin transactions carrying OP_RETURN messages, with the actors initially offering to return "most" of the Bitcoin after Blockstream patched the undisclosed network vulnerability. About 598.5 BTC remains in the withdrawal-linked address after the repayment, worth roughly $46 million based on current Bitcoin prices, though its dollar value changes with the market. No public agreement has identified the remaining Bitcoin as an approved security bounty, and the actors have not publicly stated whether they plan to return another portion. The actors had initially described themselves as "whitehats" and communicated with Blockstream through messages embedded in Bitcoin transactions, before demanding that Blockstream pay a 10% bounty using its own money or leave Liquid holders facing a loss.
The Liquid Network incident represents another dent to crypto's reputation as the industry tries to convince banks and institutional investors that digital assets can become part of mainstream financial infrastructure. According to Bloomberg, the damage extends beyond the Bitcoin that was taken, highlighting risks in the layers surrounding a blockchain — the wallets, custody arrangements and transaction infrastructure that users ultimately have to rely on. Nikhil Raghuveera, chief executive of Predicate, said "Continued exploits reinforce to global fintechs and institutions that decentralized finance is still not ready for prime time." The incident demonstrates that even when the underlying blockchain continues to operate, the systems built around it can fail, as noted by industry experts. Ziqing Ang, head of policy in APAC at TRM Labs, said "These incidents demonstrate the vulnerabilities sit at operational and infrastructure layers, not the base consensus mechanisms." Blockstream maintained that it would continue working with law enforcement agencies, exchanges, service providers, and forensic specialists to trace the remaining Bitcoin and identify those responsible. The company thanked engineers, cryptographers and security researchers who had helped identify and patch vulnerabilities and linked part of the security pressure facing open-source projects to advances in artificial intelligence, noting that teams across the Bitcoin ecosystem have been dedicating time to finding and fixing weaknesses in one another's products.
