Hackers Took $320M in Bitcoin, Now Want Blockstream to Fix the Hole First

Hackers Took $320M in Bitcoin, Now Want Blockstream to Fix the Hole First

The group that drained nearly 4,000 BTC from the Liquid Network is holding the funds hostage to a patch — and Blockstream has no choice but to negotiate.

In one of the strangest standoffs in Bitcoin's history, the purported white-hat hackers behind the $320 million Liquid Network exploit have told Blockstream they will return "most" of the seized Bitcoin, but only after the vulnerability used to pull it off has been formally fixed. That condition flips the typical hack recovery script completely upside down.

This Is Not a Normal Hack Story

Most exploits end one of two ways: the funds vanish forever, or the attacker gets caught and quietly returns everything in exchange for a bug bounty and legal immunity. This is neither. The Liquid hackers are not running. They are not hiding. They are negotiating from a position of strength, holding 4,000 BTC as collateral against a security fix they claim Blockstream should have already shipped.

The move signals something the broader Bitcoin community needs to sit with: a major sidechain infrastructure used by exchanges and institutions had a vulnerability serious enough to lose $320 million, and the people who found it are now essentially doing Blockstream's security roadmap for them.

What "Most" Actually Means

The word "most" is doing a lot of work in that statement. If the hackers return 90% of 4,000 BTC, they pocket roughly 400 BTC, worth around $32 million at current prices. If "most" means 75%, they walk away with $80 million. Blockstream has not publicly confirmed what negotiation terms, if any, are on the table. That ambiguity alone should concern every exchange or custodian running on Liquid infrastructure right now.

The Vulnerability Is Still Open

Here is the part that should stop you cold: the exploit has not been patched yet. The hackers have made their return conditional on the fix, which means the window is still open. Any sophisticated actor who reverse-engineers the exploit vector from public information about this incident could attempt their own drain before the patch ships.

What to Watch Right Now

If you hold assets on any platform that uses Liquid Network for settlement or custody, ask directly whether your funds are exposed. Watch for an official Blockstream patch announcement, which will likely move BTC price on the news alone. If the hackers follow through and return the funds after the fix, expect a short-term confidence bounce in Bitcoin Layer 2 infrastructure narratives. If they do not return the funds after the patch ships, the conversation about white-hat credibility in crypto gets a lot darker, fast.

The clock is running. Blockstream needs to move.