Blockstream Rejects Liquid Ransom as $46M Stays Unreturned

Liquid’s 598.5 BTC shortfall remains unresolved

TRM Labs’ September 8 analysis valued the original theft at about $319 million and the returned 3,400 BTC at roughly $272 million at the prices used in its report. It identified 598.5 BTC as remaining with the attackers. Those historical dollar amounts should not be combined with today’s valuation as though prices were unchanged.

The loss-impact check for this article, completed at 16:59 UTC on September 12, also examined the Bitcoin address receiving the retained funds. Its confirmed balance was approximately 598.5006 BTC. Small incoming transfers mean an address balance is not an exact measure of the original stolen amount.

A September 9 Bitcoin transaction contains the attackers’ demand for a 10% payment described as a bug bounty. The demand is evidence of the dispute, not an agreed compensation arrangement or proof of the allegations embedded in that message.

Liquid’s official incident report said roughly 4,000 unbacked L-BTC had been created and exchanged through SideSwap for actual Bitcoin. The reserve held about 4,205 BTC before the incident and fell to 197 BTC after the exploit and other withdrawals processed before the halt.

The reviewed disclosures do not establish a count of individual victims whose private wallets were emptied. They describe a loss from shared backing assets. SideSwap says its customers retained control of their wallet keys and token balances, although unchanged token counts do not resolve the reserve deficit or redemption restrictions.

No additional successful theft wave or revised aggregate loss total was established in the sources checked. That separates this incident from a series of individual wallet drains such as the previously reported Coldcard attack waves.

SideSwap opens deposits while Bitcoin redemptions stay closed

Liquid’s September 10 restart notice said block production and transactions had resumed while peg-outs stayed disabled. A peg-out burns L-BTC and releases Bitcoin from the Federation reserve. Ordinary transfers on Liquid do not complete that conversion.

SideSwap reopened its markets on September 10 and reopened peg-ins the following day. Its September 11 notice says each deposited BTC produces one L-BTC before the service’s 0.1% fee. Peg-outs remain closed both at SideSwap and across the Federation process.

The same notice cites 4,229 L-BTC in circulation against 3,627 BTC in reserves on September 11. Dividing those figures gives about 85.8% coverage and a difference of 602 BTC. This dated reserve comparison is not the same calculation as the 598.5 BTC still attributed to the attackers.

It also is not a quoted L-BTC market price or an announced haircut. A reserve ratio, a trading price and the final amount recovered by holders answer different questions. The public figures alone cannot settle all three.

In its market-reopening explanation, SideSwap cited Adam Back’s statement that the peg would be covered one-to-one. It said the method and timing were for Blockstream and the Federation to announce, and that it had no independent insight into those arrangements.

SideSwap’s order books let buyers and sellers establish an L-BTC price while the direct redemption route is closed. Its notice warned of thin books and potentially sharp moves immediately after reopening. Market access therefore does not establish that a holder can exchange every L-BTC for one BTC on demand.

Other Liquid assets, including USDt and DePix, have their own issuers and backing arrangements, according to SideSwap. Their reserves should not be treated as interchangeable with the Bitcoin supporting L-BTC. They nevertheless depend on a functioning network, where fees are paid in L-BTC.

Elements patch and phishing warnings shape recovery

The Elements 23.3.4 release, published September 9, includes a change to strengthen range-proof cache keys. Range proofs let nodes check that concealed transaction amounts are valid; caching reuses results rather than performing every expensive calculation again.

Liquid attributed the exploit to that verification process and said no signing keys were compromised. The distinction places the failure in transaction validation, rather than establishing that Bitcoin’s underlying protocol or customers’ recovery phrases were broken.

In its September 9 account, SideSwap accepted responsibility for keeping its authorization key online with automatic payouts and for lacking adequate order-size, velocity and wallet-history checks. It said those controls allowed a very large order to proceed without human review.

SideSwap also said it returned approximately 4 BTC in fees from the order to the Federation. That reimbursement is distinct from the attackers’ 3,400 BTC return. Its planned review covers key handling and payout controls alongside the network’s broader security work.

Blockstream’s September 9 phishing warning says impersonators are exploiting the disruption with fake updates, reimbursement claims and recovery requests. The company says the incident does not require users to move funds, enter recovery phrases or install software sent by email.

Broader Bitcoin sentiment was in the greed category on September 12, with Alternative.me’s index at 63, up from 56 a day earlier. That market-wide indicator does not measure Liquid’s reserve adequacy or the likelihood of recovering the remaining funds.

The next verifiable milestones are a disclosed plan for full backing, completion of the security review and a peg-out reopening notice. The sources reviewed did not provide a firm redemption date or a finalized funding mechanism for the shortfall.