Blockstream refuses to pay ransom over $47M Liquid bitcoin hack: 'It is theft'

Blockstream, the company behind the Liquid bitcoin sidechain, has publicly refused to pay a ransom for the return of about $47 million in bitcoin taken in a hack of Liquid, according to Decrypt. The company's position, per the headline of that report, is blunt: "It is theft."

That is close to the extent of what has been established on the record. Decrypt's account, published 11 September, frames the episode as a breach of Liquid — the federated Bitcoin sidechain Blockstream launched in 2018, on which bitcoin is represented by the pegged asset L-BTC — followed by a demand for payment in exchange for returning the coins, and Blockstream declining. The exact mechanics of the breach, when it occurred, whether it hit the network's peg, a federation member, or a connected service, and the terms of the ransom demand were not detailed in the reporting available. Blockstream's characterization of the loss as "theft" rather than a negotiable recovery is the company's own framing.

The dollar figure is a function of price. Decrypt's ticker had bitcoin at roughly $78,639 at the time of writing, so "$47 million" is a valuation of whatever quantity of bitcoin was taken at that level, not a fixed sum — the underlying coin count wasn't disclosed.

Key facts

• Blockstream refused a ransom for the return of ~$47M in bitcoin from a hack of its Liquid network, and called it theft (Decrypt, 11 Sept 2026).
• Liquid is a federated Bitcoin sidechain built by Blockstream; the breach's mechanics, timing and exact scope were not specified in the reporting (Decrypt).
• Bitcoin traded around $78,639 per Decrypt's price data — the basis for the ~$47M valuation; the number of coins taken was not disclosed.

The real-world read

Handle this one carefully, because the confirmed detail is thin. The account rests on a single secondary outlet, Decrypt, rather than a primary Blockstream statement, an on-chain breakdown, or a filing — none of which are in hand. The "$47 million" is a price-derived headline number, not a disclosed coin figure, and it will move with bitcoin. Most of what a reader would want to know — how the funds were taken, whether Liquid's peg or federation was compromised versus a single custodian or service, and what the attacker actually demanded — hasn't been laid out publicly.

The framing to watch is Blockstream's own. "It is theft" is a defensible stance, but it is also the position of the party that runs the network and has an interest in projecting that its infrastructure was attacked rather than that it failed. Refusing to negotiate is not the same as recovering the funds, and no recovery has been confirmed. Until Blockstream publishes specifics or on-chain evidence surfaces, the scope of this remains the company's word plus one report.

This is reporting, not financial advice.

Sources

• Decrypt (11 Sept 2026) — reported that Blockstream refused a ransom for ~$47M in bitcoin from a Liquid hack and called it theft; also the source of the ~$78,639 bitcoin price used to value the loss. Secondary reporting; no primary Blockstream statement or on-chain data was available to corroborate the specifics.