Blockstream Refuses to Pay Ransom Over Liquid Sidechain Exploit

Blockstream has publicly refused to pay a ransom demanded by attackers behind the exploit of its Liquid sidechain, after the attackers returned around 3,400 BTC but retained roughly 598.5 BTC and asked for a 10% bounty on the stolen funds. The company rejected the framing of the attackers as white-hat researchers and says it will pursue recovery through law enforcement, exchanges, service providers and forensic specialists if the remaining funds are not handed back.

The dispute has drawn attention because it tests how crypto infrastructure providers respond when attackers attempt to negotiate a fee for returning stolen funds. Ledger CTO Charles Guillemet also pushed back on the white-hat label, comparing the arrangement to extortion if the retained bitcoin was effectively a reward negotiated after the fact. No law enforcement filing, agency or criminal charge has yet been confirmed, so the theft characterisation reflects Blockstream's stated position rather than a legal finding.

The incident is a reminder that so-called 'white-hat' claims following a hack should be treated cautiously, especially when attackers retain funds and demand payment. Businesses using cryptocurrency infrastructure, exchanges or custodial services should monitor how such disputes are resolved, as they can set precedents for how similar incidents are handled industry-wide.