The Liquid Network exploit has turned a technical bug into a very human standoff: nearly 600 BTC remain missing, and Blockstream says it will not pay to get them back.
The company said Sept. 11 that it had rejected a ransom demand from the actors behind the Sept. 6 incident, pushing back on their claim that they were white-hat researchers. Blockstream says the unauthorized removal and continued withholding of funds amounts to theft.
The dispute comes as Liquid, a Bitcoin sidechain operated through Blockstream’s ecosystem, cautiously returns to normal operations. Block production and transactions resumed on Sept. 10, but users still cannot move bitcoin out of the network through peg-outs, the process that converts L-BTC back into BTC.
The Liquid Network exploit was more than a stolen-Bitcoin story
The incident began with a flaw in the way nodes running Elements software handled cached range-proof verifications.
Range proofs are cryptographic checks used to establish that certain values in a transaction are valid without revealing the underlying amounts. In this case, the verification cache could cause unbacked L-BTC to be accepted as legitimate before a peg-out was processed.
That distinction matters. According to Liquid’s Sept. 8 incident report, no private keys were compromised.
Instead, the Liquid Network exploit allowed attackers to create roughly 4,000 L-BTC that were not actually backed by bitcoin held in the network’s reserve. Those tokens were then converted through Liquid’s normal peg-out mechanism, releasing about 4,000 BTC.
The episode exposed something less cinematic than a stolen key but arguably just as consequential: a software-level failure in the machinery responsible for deciding which assets could leave the system.
Most of the bitcoin did eventually come back.
Liquid said the actors returned 3,400 BTC to the Liquid Federation peg wallet on Sept. 7. By the time of the company’s Sept. 8 accounting, approximately 598.5 BTC were still outstanding — roughly 15% of the original amount taken.
The actors also left a message on the Bitcoin blockchain identifying themselves as white-hat security researchers and asking to be contacted about the vulnerability.
Blockstream isn’t buying that framing.
“Taking assets without authorization and withholding their return is a crime, not responsible disclosure,” the company said. “It is not white-hat activity. It is theft.”
That puts the remaining bitcoin at the center of a very different kind of negotiation. Blockstream said earlier engagement was aimed at recovering user funds, not accepting the attackers’ characterization of the incident or agreeing to their demands.
The company also warned that paying a ransom could create a difficult precedent for developers of open-source Bitcoin infrastructure, potentially exposing them to demands far beyond the economic value of their direct participation in a project.
For users, however, the philosophical debate is secondary to a much simpler question: when does the missing bitcoin come back?
The Liquid Network exploit has not fully ended
Liquid released the emergency Elements v23.3.4 update on Sept. 9 to address the proof-verification cache vulnerability.
The network then resumed block production and transactions on Sept. 10. But peg-outs remained disabled as a precaution while the recovery effort continued.
Blockstream said it will now work with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible if the remaining funds are not returned.
That makes the incident bigger than a software patch. The technical vulnerability may have been addressed, but the operational and legal fallout is still unfolding.
For the broader crypto industry, the episode is another reminder that security failures do not always arrive as dramatic private-key compromises. Sometimes they hide inside the quieter plumbing — the caches, validation rules and transaction processes that users rarely see until something breaks.
In the case of the Liquid Network exploit, most of the bitcoin has been recovered. The remaining 598.5 BTC, however, are still the unresolved part of the story.