# Blockstream Refuses to Pay Hackers $47M Ransom for Stolen Bitcoin Firm vows legal action after hackers return most of $320M loot but keep 598 BTC. - **Source:** [INCRYPTED](https://brifing.si/source/7cd4625d-3f08-4cc1-983d-4c7d991839ba) - **Published:** 2026-09-11 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/aefb3afb-62e2-44fe-a111-f786c11bb849 ## The $320M Heist On September 6, hackers exploited a vulnerability in Blockstream's Elements software to create 4,000 unbacked L-BTC tokens, which they then used to steal equivalent real bitcoin from the Liquid Network. The attack drained approximately $320 million worth of BTC from the sidechain's reserves before the loophole was patched. ## Partial Funds Return After Blockstream implemented network fixes, the attackers returned 3,400 BTC ($272M) but retained 598.5 BTC ($47M). The company maintains ongoing negotiations while refusing the hackers' demand for 10% of stolen funds as a 'white hat' bounty. Blockchain records show the remaining coins still sit at the attacker's address. ## No-Ransom Stance Blockstream CEO Adam Back publicly denounced the theft, stating: 'Taking assets without permission isn't white hat hacking - it's criminal theft.' The firm warned of collaborating with global law enforcement, crypto exchanges, and blockchain forensic firms like Chainalysis to trace the funds if not voluntarily returned. ## Liquid Network Fallout The breach forced Blockstream to temporarily halt Liquid Network operations from September 6-10. While block production resumed after emergency updates, bitcoin deposits/withdrawals remained suspended longer. The incident marks the second major 2023 attack on cryptocurrency sidechains after Euler Finance's $197M loss. ## Vulnerability Analysis Security researchers found the exploit allowed minting synthetic L-BTC without bitcoin collateral. Hackers used SideSwap service to convert these to real BTC. Unlike 2022's $625M Ronin Bridge hack, this required technical sophistication rather than social engineering, highlighting persistent DeFi security challenges. ## Market Implications The attack briefly depressed bitcoin prices by 2.3% before recovery. Analysts note such incidents test institutional crypto adoption, though Liquid's enterprise users weren't directly affected. The remaining $47M in limbo represents 0.03% of Bitcoin's circulating supply - negligible for market liquidity but significant for trust. ## Legal Precedents Blockstream's no-ransom approach follows US Treasury 2020 advisories against payments to sanctioned entities. Successful prosecutions exist - like 2021's Bitfinex hackers sentenced to prison. However, cross-border enforcement remains complex, especially with mixers like Tornado Cash complicating tracing. ## Security Wake-Up Call This breach underscores critical vulnerabilities in bitcoin sidechains despite their touted security. As Layer 2 solutions gain traction, expect stricter audits and insurance requirements. Blockstream's transparency sets a benchmark, but the unresolved $47M questions whether firms can truly deter crypto theft without concessions. ## Sources covering this story - https://incrypted.com/blockstream-otkazalas-platyt-hakeram-liquid-vykup-za-ostavshyesja-598-btc/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._