Blockstream refuses ransom demand after $320 million Liquid Network bitcoin exploit

Blockstream has refused a 10% bug bounty demand from attackers who exploited its Liquid Network sidechain on September 6, 2026. The exploiters used an inflation bug in the Elements software to drain 4,000 BTC, worth $320 million. Although the self-described white hats returned 3,400 BTC, they withheld 598.5 BTC to force a payout. Blockstream rejected the terms, labeled the act as theft rather than white-hat activity, and threatened legal action, leaving L-BTC only 85% backed.

Liquid Network exploit drainage

• ▪On September 6, 2026, attackers exploited Blockstream's Liquid Network, draining approximately 4,000 bitcoin worth about $320 million from the federation reserves.
• ▪The Liquid Network exploit drained nearly 95% of the federation's 4,200 bitcoin reserves, leaving just over 207 bitcoin in the treasury.
• ▪Following the September 6, 2026 exploit, Liquid Network operators disabled bridge nodes, paused the sidechain, and instructed exchanges to pause L-BTC deposits and withdrawals.

Elements software inflation bug

• ▪Blockstream released Elements software version v23.3.4 to patch the vulnerability, allowing Liquid Network to resume block production and transaction processing by September 10, 2026.
• ▪Attackers exploited the Elements software bug to mint over 4,000 unbacked L-BTC and converted them to real bitcoin using SideSwap's peg-out authorization key.
• ▪The Liquid Network exploit was caused by an inflation vulnerability in the caching of range proof verifications in Elements, the underlying software of the sidechain.

Bitcoin blockchain messaging exchange

• ▪The attackers initiated communication with Blockstream on September 6, 2026, by attaching the public OP_RETURN message 'we are whitehats. contact us on chain' to a transaction.
• ▪The attacker's bitcoin address became flooded with spam, including meme coin promotions, financial pleas, and laundering advice from various blockchain users.

Partial fund return standoff

• ▪Because 598.5 bitcoin remains unreturned, L-BTC tokens circulating on the Liquid Network are currently only about 85% backed by real bitcoin reserves.
• ▪On September 7, 2026, the attackers returned approximately 3,400 bitcoin to the Liquid Federation wallet, leaving 598.5 bitcoin under the attackers' control.
• ▪In an on-chain message on September 9, 2026, the attackers demanded a 10% bug bounty from Blockstream, threatening to leave holders with a 15% loss if refused.

Blockstream ransom payment refusal

• ▪On September 11, 2026, Blockstream officially refused the attackers' 10% ransom demand, stating it will not pay for the return of stolen property.
• ▪Blockstream warned that if the remaining 598.5 bitcoin is not returned, the company will work with law enforcement and forensic specialists to trace the assets.

White-hat hacker legitimacy dispute

• ▪Blockstream rejected the attackers' self-characterization as white-hat hackers, declaring that taking assets without authorization and withholding them is a crime.
• ▪Blockstream argued that paying a large bounty to the attackers would set a damaging precedent for open-source developers in the Bitcoin community.

Debatable claims

• ▪Blockstream should pay the 10% bounty to recover the remaining Liquid Network bitcoin
• ▪The Liquid Network exploiters should be recognized as ethical white-hat hackers