Blockstream just drew a line in the sand. After recovering roughly 3,400 BTC from the 4,000 BTC drained from its Liquid Network federation wallet on September 6, the company announced on September 11 that it will not pay a ransom for the remaining 598.5 BTC, worth approximately $47 million.
The company’s position is straightforward: compensating attackers for returning stolen assets is theft negotiation, not responsible disclosure, and doing so would create a playbook for every future exploit in the industry.
What happened on the Liquid Network
The exploit targeted a software bug in the Elements codebase, the open-source framework underpinning Blockstream’s Liquid sidechain. The vulnerability allowed the creation of unbacked L-BTC, the network’s pegged token, which was then swapped for real BTC from the federation wallet.
Critically, this was not a compromise of the federation’s signing keys. The multi-signature security model that governs Liquid’s custody remained intact. The attackers exploited a logic flaw in how the network validated peg transactions.
