Blockstream said it will not pay a ransom to recover bitcoin stolen from the Liquid Network, according to a Wu Blockchain report. The company argues that taking assets without authorization and withholding their return constitutes theft rather than white-hat activity. Its position remains unchanged even after most of the stolen bitcoin was sent back.
The attacker previously returned about 3,400 BTC, which the report described as roughly 85% of the stolen funds. Around 598.5 BTC remains outstanding. Those figures leave the incident in an unusual position: the majority of the bitcoin has been recovered, but a substantial remainder is still being withheld while Blockstream rejects the ransom demand. Earlier BTC-Pulse coverage examined the initial questions surrounding the event in Ledger CTO: 4,000 BTC Pegged Out of Liquid Bridge, ‘Whitehat’ Claim Raises Doubts.
Blockstream draws a firm line on the remaining BTC
Blockstream’s statement frames the unresolved portion as a matter of unauthorized control over stolen assets, not as the final stage of a white-hat negotiation. By refusing payment, the company is rejecting the idea that returning part of the bitcoin entitles the attacker to compensation for the remainder. The key dispute is therefore not whether funds came back—the reported 3,400 BTC return establishes that—but whether withholding the remaining 598.5 BTC can be treated as legitimate leverage.
The company said it will pursue lawful recovery efforts if the outstanding funds are not returned. Its stated plan involves working with law enforcement, exchanges and forensic specialists. That response identifies the channels Blockstream expects to use rather than accepting the attacker’s demand. For broader context on bitcoin held within another part of the market, BTC-Pulse has also covered how Binance Bitcoin Reserves Hit Two-Year High at 693,000 BTC.
The white-hat description remains contested
The report also records a different reaction from SlowMist founder Cos, who called Blockstream’s hardline response “puzzling.” At the same time, Cos noted that there may be communications between the two sides that have not been disclosed. That caveat matters because the public account provides Blockstream’s stated legal and ethical position, the returned and outstanding amounts, and Cos’s reaction, but not a complete record of any private exchange.
Based on the disclosed details, the clearest facts are the partial return, the unpaid ransom demand and Blockstream’s promise to seek lawful recovery. The label attached to the attacker’s conduct remains central because Blockstream explicitly rejects the white-hat characterization. The unresolved 598.5 BTC now separates a mostly completed return from a fully resolved incident. Elsewhere in the bitcoin infrastructure sector, VerifiedX Launches $15M Bitcoin Infrastructure Round provides additional industry context.
What remains unresolved
The next publicly stated step depends on whether the remaining bitcoin is returned. If it is not, Blockstream says it will continue through law enforcement, exchange cooperation and forensic work. The source does not disclose a deadline, identify the attacker or detail the alleged private communications. Until more information is released, the outstanding 598.5 BTC and the disagreement over the attacker’s claimed role remain the incident’s two central unresolved issues.
