Blockstream on Friday publicly refused to pay a ransom for roughly $47 million in Bitcoin still held by the attackers who drained its Liquid Network sidechain on September 6, ending nearly a week of negotiation with a group that had branded itself "whitehats." Approximately 4,000 BTC, worth about $320 million at the time, left the Liquid Federation wallet in a single transaction. The attackers returned 3,400 BTC on Monday, roughly 85 percent of the take, then demanded a 10 percent bounty for the remaining 598.5 BTC. "Taking assets without authorization and withholding their return is a crime, not responsible disclosure," Blockstream said. "It is not white-hat activity. It is theft."
What Happened
Liquid Network, a Bitcoin sidechain developed by Blockstream and used by exchanges and financial institutions, disclosed the incident on X shortly after 4:25pm New York time on Sunday, September 6, describing the perpetrators cautiously as "purported white-hat hackers." Decrypt reports that SideSwap, a federation member operating a peg-out service, received 4,000 L-BTC from what looked like an ordinary customer at 14:05 UTC, burned the tokens under a valid authorization, and 23 minutes later the federation paid out 3,996 BTC. ETHNews places the settling transaction at Bitcoin block 965,783 at 14:28:56 UTC, a single transaction with 83 inputs.
Protos reports that all 83 inputs were spent with exactly 11 valid signatures on the federation's 11-of-15 multisig branch, and that the network's emergency recovery path (two of three backup keys plus an 8,064-block timelock, roughly 56 days) was bypassed entirely because it was never needed. Nothing was forced. The attacker simply submitted a peg-out request that every validating functionary agreed was legitimate.
The federation wallet held roughly 4,200 BTC before the incident and about 200 BTC after, a loss of approximately 95 percent of reserves. Decrypt's follow-up puts the post-incident reserve at 197 BTC; The Register and Chainalysis both describe it as roughly 200. Mempool.space, itself a federation member, logged the event in its real-time audit as "an unauthorized -4019 BTC withdrawal," a figure slightly higher than the commonly cited ~4,000. Protos notes that the official Liquid.net dashboard did not immediately reflect the loss while Mempool.space's audit did, and that Bitcoin Core contributor Antoine Poinsot observed Liquid block 4,050,336 (containing the peg-out) was rejected by Mempool's node but accepted by Blockstream's.
Liquid disabled its bridge nodes, asked exchanges to suspend L-BTC deposits and withdrawals, and effectively paused the sidechain. Blockstream patched the bridge nodes within roughly ten hours and shipped Elements v23.3.4 on Wednesday. Liquid resumed producing blocks and processing transactions on Thursday, with peg-outs still disabled as a precaution during what the company called "the final stage of recovery."
What Was Taken
This was a theft of bearer assets, not data. No customer records, credentials, or personally identifiable information have been reported stolen by any source.
Figures across the reporting are largely consistent but not identical, and worth stating precisely:
- Total drained: approximately 4,000 BTC (~$320 million), reported consistently by The Register, Chainalysis, Decrypt, Protos, and ETHNews. The actual peg-out payment is cited as 3,996 BTC (Decrypt, ETHNews), while Mempool.space's federation audit logged 4,019 BTC as unauthorized. Protos reports the attacker address held 3,998 BTC by Monday morning.
- Returned: 3,400 BTC, roughly 85 percent (Decrypt, Chainalysis, Bitcoin.com News).
- Still outstanding: 598.5 BTC, approximately $47 million, sitting unmoved at the withdrawal address.
- Reserve remaining post-incident: 197 BTC (Decrypt) to roughly 200 BTC (The Register, Chainalysis, Decrypt's earlier report), against a pre-incident balance of about 4,200 BTC.
The exposure sits with L-BTC holders. Bitcoin.com News reports the attackers warned that refusing their demand could leave L-BTC holders facing a 15 percent loss, a threat Blockstream answered directly: "Bitcoin is hard money and can't be minted without costs; Bitcoin doesn't haircut users to pay a ransom."
Why It Matters
The underlying Bitcoin blockchain was never compromised. Every signature on the drain transaction was cryptographically valid, no private key was stolen, and no federation member was breached. That is the entire point. As Chainalysis frames it, building financial layers on top of a secure base chain introduces new failure modes that the base chain's security properties do not cover. The trust boundary that failed was not key custody; it was transaction validation.
For anyone running a bridge, sidechain, or Layer 2 with a custodial or federated reserve, the lesson is that a validation bug is functionally equivalent to a key compromise. An attacker who can convince the validator that fake collateral is real does not need to steal anything. The system hands over the funds through its normal, authorized path, and every log looks clean.
The ransom dimension is equally significant. The attackers claimed white-hat status from the first OP_RETURN message, negotiated through PGP-signed on-chain messages and then encrypted channels, returned most of the funds, and then demanded a 10 percent bounty backed by an implied threat to users. Blockstream drew a hard line, saying it would not establish a precedent in which open-source developers are forced to pay a ransom over software built for the Bitcoin community, and that it would pursue "every lawful avenue," working with law enforcement, exchanges, service providers, and forensic specialists. It also pointed out that Bitcoin's transparency cuts against the holder: transactions and the evidence attached to them do not disappear. Samson Mow, former Blockstream CSO, warned the group may be underestimating the consequences; the attackers had earlier called Blockstream "delusional, greedy, and arrogant."
One detail deserves scrutiny from anyone running patch-management for a chain project. Decrypt reports that a fix for the bug was added to Liquid's underlying software five weeks before the incident, though Blockstream has not publicly explained the bug in detail. If accurate, the window between an upstream fix landing and production nodes running it was the actual exposure.
The Attack Technique
The attackers exploited a validation flaw in Elements, the open-source software Liquid runs on, to mint L-BTC that no Bitcoin backed. Decrypt's later reporting attributes it specifically to a flaw in how Liquid nodes cache range proof verifications. Liquid uses confidential transactions, where amounts are hidden behind cryptographic commitments and range proofs demonstrate an output's value is valid without revealing it. A caching defect in that verification path let the attackers pass off issuance that should have been rejected.
With unbacked L-BTC in hand, the exit was mundane. The attackers routed the tokens into SideSwap's peg-out service as a routine order. SideSwap's Peg-out Authorization Key sits on the federation whitelist; PAKs let functionaries recognize destinations authorized to receive peg-outs. SideSwap burned the incoming L-BTC under valid authorization and the federation released real reserve BTC to a fresh address. Liquid has stated that neither SideSwap's key nor any other federation key was compromised, and SideSwap said none of its systems were breached, pointing to the third-party Elements bug.
Communications ran through the Bitcoin blockchain itself. The attacker address published an OP_RETURN message reading "we are whitehats. contact us on chain." Blockstream replied on-chain with security team contact details, and per Protos a follow-up from the attackers offered a Signal handle. The parties moved to encrypted channels using PGP-signed messages. The attackers' stated condition was patch-first: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix."
Blockstream also warned separately that scammers are targeting Liquid node operators with fake material, a predictable second wave that follows any high-profile patch scramble.
What Organizations Should Do
- Treat validation logic as custody-critical. If you operate a bridge, sidechain, or wrapped-asset system, audit the code path that decides whether collateral is real with the same rigor as key management. Give particular attention to caching and memoization in cryptographic verification, where a cache hit that skips a check is indistinguishable from a check that passed.
- Close the upstream-fix-to-production gap. Track security-relevant commits in the software your infrastructure depends on and treat an unexplained validation fix as a live exposure until deployed. Establish an SLA for how quickly consensus-critical patches reach production nodes, and verify deployment rather than assuming it.
- Run independent reserve attestation. Mempool.space's audit flagged the unauthorized withdrawal when the official dashboard did not. Monitoring that is operated by a party other than the system's developer, and that alerts on reserve deltas in real time, is the difference between minutes and hours of detection lag.
- Alert on validation divergence between nodes. The peg-out block was accepted by one federation member's node and rejected by another's. Consensus disagreement between independent implementations or versions is one of the highest-signal indicators available on a distributed system. Instrument it and page on it.
- Add economic invariants to authorization checks. A peg-out that moves 95 percent of a reserve in one transaction should trip a rate limit, a value ceiling, or a human approval gate regardless of how many valid signatures accompany it. Cryptographic validity is not the same as operational plausibility.
- Decide your ransom position before you need it. Blockstream had a stated policy and stuck to it publicly. Write down in advance who authorizes payment decisions, where the line sits between good-faith recovery engagement and rewarding extortion, and at what point law enforcement, exchanges, and chain-analysis firms get engaged.
- Expect the phishing wave. After public disclosure, node operators and users become targets for fake patches, fake support, and fake recovery services. Publish signed release artifacts, state your only official channels clearly, and repeat it.
Sources: Blockstream Refuses Ransom for Return of $47M in Bitcoin from Liqui... | Hackers drain $320M in Bitcoin from Liquid Network, claim they're ... | How The $320M Exploit of Liquid Network Went Down - Chainalysis | 'Purported White-Hat Hackers' Withdraw $320M in Bitcoin From Liquid... | How 4,000 BTC walked out of Blockstream’s Liquid Network | Liquid Network Exploit Drains $320M, Blockstream Halts Sidechain -... | 'Return the Bitcoin': Blockstream Draws Line After 4,000 BTC Hack –... | 'We Will Not Pay': Blockstream Rejects 10% Bounty Demand From ...