'Return the bitcoin': Blockstream refuses ransom demand for remaining 600 BTC from Liquid exploit

"Return the bitcoin," Blockstream told those responsible for the Liquid Network exploit on Friday, saying it would not pay a bounty for the remaining 598.5 BTC.

Blockstream said it had tried to secure the return of the funds in good faith but rejected the terms being demanded. "Taking assets without authorization and withholding their return is a crime, not responsible disclosure," the Adam Back-founded Bitcoin infrastructure firm said. "It is not white-hat activity. It is theft."

"We will not be a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation," Blockstream added, thanking the Bitcoin community for its support. 

The company said the attacker still had an opportunity to resolve the situation and return the bitcoin (BTC). However, if the funds are not returned, it said it will work with law enforcement, exchanges, service providers, forensic specialists, and other parties to trace and recover the assets and identify those responsible.

"Transactions do not disappear, and neither does the evidence they leave behind," Blockstream added. "We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds."

Liquid recovery

Liquid's Sept. 8 incident report said the vulnerability was in the caching of range proof verifications in Elements, the underlying software used to run the Liquid Network. About 4,000 LBTC was created without backing by bitcoin held in reserve.

The exploiter then used the Liquid Network wallet and trading platform SideSwap, which, as a Liquid Federation member, holds a peg-out authorization key, to convert the unbacked LBTC to BTC through a standard peg-out. Liquid said its network operators were not hacked and no keys were compromised. 

On Sept. 7, the exploiter returned roughly 3,400 BTC following an earlier onchain message telling Blockstream to "fix the bug first" before "most" of the funds would be sent back. However, about 598.5 BTC was not returned.

A new Elements release, v23.3.4, was deployed on Sept. 9. Liquid started producing blocks again on Sept. 10, and transactions also later resumed the same day. However, peg-outs remain disabled as a precautionary measure, Blockstream said, "while the final stage of recovery continues."

In a Wednesday OP_RETURN message, the exploiter had asked Blockstream for 10% as a bug bounty, claiming the company had spent $1.5 million, "maybe even 0," securing $5 billion in assets. "You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess," the message read.