Blockstream Rejects Ransom as Liquid Hackers Hold Nearly 600 BTC

Blockstream rejects ransom demand

Blockstream has rejected a ransom demand from hackers who are holding nearly 600 BTC linked to Liquid, according to the primary report. Rather than negotiate a payment, the company said it would pursue recovery through cooperation with law enforcement, cryptocurrency exchanges and blockchain forensic specialists.

The decision places the focus on tracing and restricting the movement of the stolen Bitcoin. Because Bitcoin transactions are recorded on a public blockchain, investigators and specialist firms can monitor addresses associated with the funds and identify attempted transfers. The ability to observe those movements does not guarantee recovery, but it can support investigations and help exchanges respond if the assets reach platforms that maintain compliance and transaction-monitoring controls.

Recovery strategy replaces ransom negotiations

Blockstream’s stated approach is based on coordination rather than a direct settlement with the attackers. The company said it would work with three groups: law enforcement agencies, exchanges and forensic specialists. Each has a different role in a potential recovery effort.

• Law enforcement: Authorities can coordinate investigations, seek information from relevant service providers and pursue legal action connected to the theft.
• Exchanges: Trading platforms may be able to flag or restrict deposits if the Bitcoin is sent to identifiable exchange-controlled addresses.
• Forensic specialists: Blockchain investigators can analyze transaction flows, track address activity and identify links between wallets and services.

The strategy also signals that Blockstream does not intend to treat the ransom demand as an acceptable mechanism for recovering the assets. No ransom amount, payment deadline or additional negotiation terms were provided in the supplied report, and the source does not describe the technical method used in the incident.

What the incident means for Liquid

The reference to Liquid connects the dispute to the Bitcoin sidechain ecosystem associated with Blockstream. The report identifies the hackers as holding nearly 600 BTC, but it does not provide further details about whether the funds were taken from a Liquid-linked system, a user account, a service provider or another connected environment. That distinction is important because the recovery process and affected parties would depend on the location and control of the compromised assets.

Until more information is released, the central confirmed development is the handling of the ransom demand. Blockstream has publicly chosen not to pay and has indicated that recovery efforts will proceed through established investigative and compliance channels. The company’s position could limit the attackers’ ability to convert or move the Bitcoin without attracting attention, although the eventual outcome will depend on how the funds are transferred and whether they reach services capable of identifying or blocking suspicious activity.

Market and security implications

A holding of nearly 600 BTC is material enough to draw attention from traders and market-monitoring firms, particularly if the wallets become active. However, the primary report does not state that the hackers have sold any of the Bitcoin or that the incident has caused a measurable market impact. The immediate market relevance is therefore tied to the possibility of future wallet movements, exchange deposits or attempts to liquidate the assets.

For digital-asset security teams, the case highlights the importance of rapid address attribution and information sharing after a theft. Exchanges that receive timely wallet intelligence can add relevant addresses to internal monitoring systems, while forensic analysis can help distinguish direct transfers from intermediary transactions. Law enforcement involvement may also affect how service providers handle account information and suspected proceeds.

Blockstream’s planned cooperation leaves the recovery effort dependent on continued monitoring and coordination. Until the Bitcoin is returned or otherwise secured, the nearly 600 BTC remains the principal asset at issue, and the investigation is expected to focus on preventing the hackers from converting or concealing it.