Blockstream rejects ransom demand as Liquid resumes blocks with roughly 598 BTC outstanding
The network's technical provider says it will not pay the party holding the remaining bitcoin; block production has resumed, but peg operations remain suspended.
By The Third AnglePublished 4 min read
Illustrative custody imagery; it does not depict Liquid's federation wallet or the incident response. Photo: Kanchanara / Unsplash · Unsplash License
Blockstream draws a line on payment
Blockstream said Friday that it will not pay a ransom to the party holding bitcoin taken from the Liquid Network's federation wallet. The Block reports that the decision concerns roughly 598.5 BTC left after the attacker returned most of the approximately 4,000 BTC withdrawn during the incident.
Liquid's official service-status page says block production has resumed in a controlled mode without transactions while the network is monitored. Functionary and bridge-node updates have been deployed, but peg operations remain suspended as the federation works to restore the BTC/LBTC reserve. Resumed blocks do not mean full operations: users still cannot rely on normal peg-in and peg-out service.
Blockstream described the withdrawal as unauthorized and said it would pursue recovery through investigative and official channels. The company also warned users about impersonators who may ask them to move funds, enter recovery phrases, install software or claim a reimbursement. Legitimate incident response should not require any of those steps.
The incident report attributes the failure to a vulnerability in caching range-proof verifications in Elements, the software underlying Liquid, rather than a compromised federation signing key. That distinction matters because a software-validation bug can create a different remediation path from a stolen private key, although it does not reduce the loss or the need to review affected services.
What users should watch next
Liquid is a Bitcoin sidechain whose federation wallet holds bitcoin backing pegged assets. Exchanges and service providers were notified and paused LBTC deposits and withdrawals during the response. The status page says other Liquid assets, including USDT, DePix and real-world-asset tokens, were not affected by the reported withdrawal; that is a scope statement, not a guarantee that every downstream service is available.
The remaining balance creates a difficult recovery problem. Returning about 85% of the withdrawn funds reduced the exposure, but the unrecovered amount remains material and full operations depend on coordination among Blockstream, federation members, exchanges and wallet providers. A ransom refusal may preserve a no-payment policy, but it does not itself restore the coins.
The next evidence is an official restart and patched software. Readers should look for a signed Liquid or Blockstream update that says bridge services have resumed, explains the deployed fix and describes any reconciliation or withdrawal limits. Social-media claims about recovered funds should be checked against those primary updates and on-chain data.
Until then, users should avoid unsolicited links and verify announcements through Liquid or Blockstream's official domains. This article summarizes public incident information and does not provide custody or investment advice. Digital assets can be lost through technical failures, operational errors and fraud even when a network's authorization keys are not compromised.
