Blockstream said on Sept. 11 that it will not pay a ransom for bitcoin taken in the Liquid Network exploit. Liquid reported on Sept. 8 that the actors had returned 3,400 BTC and that approximately 598.5 BTC remained outstanding at that time.
In a statement, Blockstream called the taking and continued withholding of the bitcoin theft rather than white-hat activity. It said that if the funds are not returned, it will work with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible.
For Liquid users, the recovery remains incomplete. The network resumed block production and transactions on Sept. 10, but peg-outs — the mechanism used to move bitcoin out of Liquid — remained disabled as a precaution while recovery work continued.
Liquid’s Sept. 8 incident report, which gave the network’s status as of 19:10 UTC that day, said the Sept. 6 exploit created about 4,000 L-BTC that was not backed by bitcoin in the network’s reserve. The actors then converted the unbacked L-BTC into BTC through Liquid’s standard peg-out process, releasing about 4,000 BTC.
The report said no private keys were compromised. Instead, the exploit targeted how nodes running the open-source Elements software cached range-proof verifications, causing the unbacked L-BTC to be accepted as valid before the peg-out was processed.
