Blockstream refused to pay a ransom demanded by hackers who still hold approximately 598 BTC from the Liquid Network exploit. The hackers withdrew roughly 4,000 Bitcoin—worth about $320 million at the time—from Liquid's federation wallet on September 6, returned 3,400 BTC after bridge nodes were patched, and are now demanding a 10% bounty paid from Blockstream's own funds. According to Blockstream, the company engaged the hackers in good faith but will not accept the terms. Liquid resumed block production on Thursday following emergency software updates, though transactions and Bitcoin transfers into and out of the network remain suspended.

This matters because it clarifies the containment perimeter. The exploit targeted a Bitcoin sidechain, not the Bitcoin mainnet, and Blockstream's refusal to pay establishes that the remaining 598 BTC exposure sits with Liquid bridge users, not the broader market. The hackers' self-description as "white hats" and their partial return of funds suggests this is a negotiation over a bug bounty rather than a traditional rug—but Blockstream has now closed that door and committed to working with law enforcement, exchanges, and forensic specialists to trace the assets. The outstanding BTC represents less than 0.003% of Bitcoin's circulating supply, and the incident does not implicate Bitcoin's base layer security.

For traders, this is a sidechain governance failure with no transmission to spot BTC or listed equities. Liquid is a federated sidechain used primarily by institutional actors for faster settlements and confidential transactions. The temporary suspension of Liquid peg-ins and peg-outs affects a narrow user base and does not cascade to other networks. There is no contagion vector and no reason for BTC to reprice on this news. Fear and Greed sits at 56, slightly below the 30-day average of 61, indicating no panic and no dislocation in broader sentiment.

The specific thing to watch is whether major exchanges flag any of the remaining 598 BTC on-chain. If forensic tracing leads to address blacklisting or law enforcement recovery, that closes the loop cleanly. If the hackers attempt to move or mix the coins and succeed, it highlights a gap in sidechain custody models—but even that outcome does not move mainnet Bitcoin. The resolution timeline is weeks to months, not hours, and there is no intraday catalyst.

Source: CoinTelegraph