Blockstream said it will not pay a ransom demand following a hack of its Liquid sidechain that resulted in the theft of approximately 598.5 Bitcoin, worth $47 million at current market prices. The company's refusal came in a statement on September 11, five days after the exploit.
Blockstream characterized the demand as extortion. "It is theft," the company said in its statement. The refusal sets a precedent in how infrastructure operators respond to large-scale cryptocurrency thefts: paying a ransom would amount to financing the attacker and incentivizing future exploits.
Liquid is a Bitcoin sidechain operated by Blockstream that enables faster transactions and confidential transfers. The network processes layered Bitcoin transfers and is used by exchanges, brokers, and institutional traders. The September 6 exploit drained a significant portion of the sidechain's collateralized assets, temporarily disrupting services that depend on Liquid's cross-chain functionality.
The 598.5 Bitcoin figure represents one of the largest amounts stolen in a single sidechain exploit. For context, the 2016 Bitfinex hack resulted in the theft of approximately 119,756 Bitcoin, though at that time the per-unit price was substantially lower. Sidechain exploits are less common than direct exchange breaches because sidechains operate with smaller total value locked and narrower user bases.
Blockstream's statement did not specify whether law enforcement had been contacted or whether the company was pursuing recovery through forensic blockchain analysis or cooperation with exchanges. The stolen Bitcoin address or addresses have not yet been publicly identified as moving funds to known laundering pools.
The refusal to negotiate stands in contrast to some past corporate responses to theft. In 2023, Ronin, the sidechain behind Axie Infinity, received a ransom negotiation following a $625 million hack, though the stolen funds were eventually recovered through blockchain analysis rather than payment. Blockstream's position aligns with growing institutional policy against ransomware payments.
the stolen Bitcoin's immobility in the short term depends on whether exchanges implement detection protocols to flag the addresses. If Blockstream or law enforcement share the address list with major trading platforms, the attacker faces difficulty converting the assets to fiat without triggering compliance reviews. The measure of success for Blockstream is whether any portion of the 598.5 Bitcoin reaches an exchange within six months.
