Blockstream Rejects Ransom Demand After Liquid Network Exploit

Theblock.Co

Blockstream Rejects Ransom Demand After Liquid Network Exploit

First seen 13 Sep 2026, 11:41 UTC • •65.3

Article Content

1 / 3

Browse articles

ThreatCluster •September 13, 2026 at 12:58 UTC

•Blockstream lost 4,000 BTC due to a Liquid Network exploit but recovered 3,400 BTC.
•The company refuses to pay a ransom, labeling the act of withholding funds as theft.
•Blockstream will work with law enforcement and forensic experts to recover the remaining 598.5 BTC.

Blockstream has refused a ransom demand from hackers who exploited the Liquid Network, draining 4,000 BTC. The attackers returned 3,400 BTC but retained approximately 598.5 BTC, demanding a 10% bounty for the return of the remaining funds. Blockstream stated that taking funds without authorization is theft and that it will not pay ransoms, emphasizing the importance of not setting a precedent for open-source developers. The company plans to collaborate with law enforcement and forensic specialists to trace the stolen coins. The vulnerability exploited was related to caching range proof verifications in Elements, the software underlying the Liquid Network. Liquid's network operators were not hacked, and no keys were compromised. Peg-outs remain disabled as a precaution while recovery efforts are ongoing.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-07

Initial exploit occurred

Hackers exploited a vulnerability in the Liquid Network, draining 4,000 BTC.

2026-09-08

Partial recovery of funds

The attacker returned approximately 3,400 BTC after demanding a fix for the vulnerability.

2026-09-09

New Elements release deployed

Blockstream deployed Elements v23.3.4 to address the vulnerability.

2026-09-10

Transactions resumed

Liquid Network began producing blocks again, but peg-outs remained disabled.

2026-09-11

Blockstream's public statement

Blockstream publicly refused the ransom demand, labeling the act as theft.

2026-09-13

International Cyber Digest coverage

International Cyber Digest reported on Blockstream's response to the hackers and the ongoing situation.

X

More articles in this cluster (2)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Organization (1)

Blockstream

Affected Platform (3)

Liquid Network
Elements
SideSwap

Relationships

Data Breach targets Liquid Network
Data Breach targets Elements
Data Breach targets SideSwap
Data Breach related to Blockstream

Following this threat?

Track Blockstream in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

Critical GitLab CVE-2026-85706 Exploited; Microsoft Issues Record 974 Patches A critical CVE-2026-85706 path-traversal vulnerability in GitLab (CVSS 10.0) was exploited in the wild just hours after its disclosure on September 12, 2026. Microsoft released its largest-ever patch batch, addressing 974 vulnerabilities, including several actively exploited Windows flaws. The GitLab flaw allows…