'Return the Bitcoin': Blockstream Draws Line After 4,000 BTC Hack

Nearly 4,000 BTC Left, but Most of It Came Back

The whole episode began Sept. 6 with something that already sounded strange enough: Nearly 4,000 BTC disappeared from reserves connected to Blockstream’s Liquid Network, and the people responsible immediately announced on the Bitcoin blockchain that they were “whitehats.” Then things got even stranger.

The group began communicating with Blockstream through tiny bitcoin transactions carrying OP_RETURN messages, effectively turning the blockchain into a public message board. After a series of public and encrypted exchanges, the group returned 3,400 BTC.

But roughly 598.5 BTC stayed behind. That is where the story went off the rails.

A 10% Bounty Turns Into an Ultimatum

Instead of simply returning the rest, the group demanded that Blockstream pay a 10% bounty using its own money. It also warned that refusing the demand could leave Liquid holders facing a 15% loss. Calling this ordinary vulnerability disclosure became increasingly difficult.

White-hat researchers generally identify security flaws, report them, and negotiate compensation through established channels. Here, nearly 600 BTC was being withheld while payment was demanded. Blockstream has now made clear that it sees the distinction very differently.

“Blockstream will not pay a ransom for the return of stolen funds,” the company stressed on Sept. 11 on X. “Taking assets without authorization and withholding their return is a crime, not responsible disclosure.”

Blockstream Says Bitcoin Holders Won’t Pay the Bill

The company also rejected the idea that Liquid users should absorb losses to satisfy the demand. “Bitcoin is hard money and can’t be minted without costs, Bitcoin doesn’t haircut users to pay a ransom,” Blockstream wrote.

That line gets to the financial heart of the dispute. Someone ultimately has to account for the nearly 600 BTC that has not been returned. Blockstream’s position is that users should not effectively finance a payout to the people who took it. The company said its earlier negotiations were conducted in good faith to recover user funds, not because it accepted the hackers’ terms.

Security Warnings Add Another Twist

There is another complication hanging over the affair. Bitcoin Red Team co-lead Calle has claimed his group warned Blockstream about the vulnerability before the exploit, quipping that it apparently cost “600 BTC to ignore an email from the red team.”

Former Blockstream Chief Security Officer Samson Mow pushed back, saying no emails were ignored. The competing accounts have not been fully reconciled, and Bitcoin Red Team has said it intends to publish its own account of the disclosure process after Blockstream releases a postmortem.

So Blockstream is now fighting two arguments at once: what happened before the exploit and what should happen to the bitcoin afterward. Beyond the loss of nearly 600 BTC, the company has also been forced to contend with the reputational fallout from the entire episode, which has quickly turned into a public relations disaster.

“Write bad quality code, have bad problems,” one X user wrote in reply to Blockstream’s latest demand. “Bitcoin is permissionless by design. Don’t go crying to the authorities now that you messed up with bad code,” the account added. “Blockstream is shooting itself in the foot by backstabbing the guy who gave them 3,400 BTC,” another X account wrote. The individual added:

“Next time Liquid gets drained, they will keep 100% of the coins. Stop being so cheap and take responsibility for your f***up.”

Blockstream Threatens a Much Bigger Hunt

Blockstream’s latest message leaves little ambiguity about the second question.

If the funds are not returned, the company says it plans to work with law enforcement, exchanges, service providers, forensic specialists and others to trace the bitcoin and identify the people responsible. The company also pointed to one inconvenient feature for anyone trying to make nearly 600 BTC disappear: Bitcoin transactions leave a permanent public trail.

For a group that originally called itself white hat, the situation has traveled a long way from a bug report. Nearly 4,000 BTC left. Most came back. Hundreds of bitcoin did not. And Blockstream’s answer to the remaining demand is now four words long:

“Return the bitcoin.”