Liquid Network Heist: Blockstream Defies Hackers, Demands Return of Stolen Bitcoin

Blockstream, a prominent Bitcoin infrastructure firm, has taken a resolute stance against hackers who recently exploited its Liquid Network, refusing to negotiate further or pay a ransom for the return of stolen funds. The incident, which Blockstream unequivocally labels as theft rather than responsible disclosure or white-hat activity, involved the unauthorized appropriation of nearly 4,000 bitcoins (BTC) from the network's reserves.

The security breach, which occurred on September 6, saw attackers exploit an inflation bug within the Liquid sidechain. This vulnerability allowed them to illicitly create over 4,000 Liquid-Bitcoin (L-BTC) tokens that were not backed by actual Bitcoin. Subsequently, these fabricated L-BTC were cashed out through SideSwap’s peg-out infrastructure, enabling the attackers to withdraw approximately 4,000 real BTC from the Liquid Federation's reserves. At the time of the exploit, the federation wallet held around 4,200 BTC, meaning the attack drained about 95% of its total reserves, valued at roughly $320 million.

Following the initial theft, a portion of the funds, specifically about 3,400 BTC (representing approximately 85% of the stolen amount), was transferred back to the Liquid Federation on September 7. However, 598.5 BTC, initially valued at over $46 million, remained under the control of the attackers, who demanded it as a ransom or "bug bounty." Communication between Blockstream and the hackers occurred through messages inscribed into Bitcoin blocks. Initially, the hackers advised Blockstream to fix the bug, stating the chain was "under risk." Later, their tone shifted, describing Blockstream as "delusional, greedy, and arrogant" and threatening to expose encrypted messages unless the company allowed them to keep 10% of the bitcoins as a bounty. They warned that refusing to pay would cause holders a "15% loss" due to Blockstream's "irresponsibility and stinginess."

Blockstream, however, firmly declared that it would "not pay a ransom for the return of stolen funds." The company stressed that "taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft." Blockstream emphasized its commitment to not abandoning its users and reiterated that "the Bitcoin community will not stop pursuing the funds."

In response to the ongoing situation, Blockstream has initiated a controlled recovery process for the Liquid Network. They released Elements v23.3.4 to patch the exploited vulnerability, and block production has since resumed, with Liquid transactions reportedly processing normally. Despite these recovery efforts, L-BTC remains about 85% backed as the 598.5 BTC are still outstanding. Blockstream has stated its intention to work with law enforcement, exchanges, service providers, and forensic specialists to trace and recover the assets and identify those responsible. The company also issued a warning, noting that Bitcoin's transaction history is permanently recorded on a public blockchain, ensuring "transactions do not disappear, and neither does the evidence they leave behind." While maintaining its firm stance, Blockstream has left an opening for the attackers to return the remaining coins, stating, "There is still an opportunity to resolve this responsibly."

This incident adds to a series of significant cryptocurrency thefts, including the July hack where over 1,800 bitcoins, worth close to $140 million, were stolen from Coldcard wallet holders. That particular exploit was attributed to the manufacturer's failure to use a true random number generator, which allowed hackers to guess investor seed phrases, highlighting broader security challenges within the crypto ecosystem.