Bitcoin infrastructure company Blockstream said it will not pay a ransom to recover funds still held by the Liquid Network hackers.

“Taking assets without authorization and withholding their return is a crime, not responsible disclosure,” Blockstream said Friday. “It is not white-hat activity. It is theft.”

The company said it had engaged with the hackers in good faith to recover user funds but would not accept their demands.

The hackers demanded that Blockstream pay a 10% bounty from its own funds in an onchain message shared by Jan3 CEO and former Blockstream chief strategy officer Samson Mow on Wednesday. They warned that Liquid holders would otherwise face a 15% loss.

Blockstream urged the hackers to return the remaining Bitcoin voluntarily. If not, it said it would work with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible. 

On Sept. 6, Liquid, a Bitcoin sidechain, paused operations after self-described white-hat hackers withdrew about 4,000 Bitcoin, then worth about $320 million, from its federation wallet.

The actors subsequently returned 3,400 BTC after Blockstream said that affected bridge nodes had been patched, leaving about 598 BTC outstanding.

Liquid resumed block production on Thursday, producing empty blocks following emergency software updates. Transactions and Bitcoin transfers into and out of the network remained suspended.

Related: ‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest