Blockstream has drawn a hard line against the hackers behind the recent Liquid Network exploit.
The firm has stated it will not pay a ransom for the return of nearly 600 Bitcoin that remain under their control.
The Bitcoin infrastructure company does not believe that the incident qualifies as white-hat hacking.
"Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft," Blockstream said.
The company said it had engaged with those responsible in good faith in an attempt to recover stolen user funds.
"We will not pay for the return of stolen property," the company said.
It has stated that it plans to pursue every available legal avenue if the remaining Bitcoin is not returned.
Liquid Network hack
The strongly worded warning comes after the massive Sept. 6 security incident involving Liquid Network, the Bitcoin sidechain developed by Blockstream.
Attackers exploited a vulnerability that allowed them to create roughly 4,000 L-BTC without the BTC that was supposed to back those tokens. They submitted L-BTC via SideSwap’s peg-out infrastructure and received almost 4,000 real BTC from Liquid’s federation reserves.
Every L-BTC circulating on Liquid is supposed to be backed one-for-one by BTC held by the Liquid Federation. The federation wallet contained roughly 4,200 BTC, meaning the exploit removed about 95% of its reserves. The Bitcoin was worth roughly $320 million at the time.
The group did return the majority of the money. On Sept. 7, approximately 3,400 BTC was transferred back to the Liquid Federation, representing roughly 85% of the Bitcoin taken. However, around 598.5 BTC remained in an address controlled by the attackers.
Multimillion-dollar "bounty"
Blockstream argued that allowing the attackers to keep such a large amount would create a damaging precedent for Bitcoin and open-source developers.
"We will not be a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation," the company said.
"Bitcoin is hard money and can’t be minted without costs," Blockstream said. "Bitcoin doesn’t haircut users to pay a ransom."
Returning to normal
Meanwhile, Liquid Network has been going through a controlled recovery process.
Blockstream released Elements v23.3.4 to address the exploited vulnerability.
Block production has since resumed, and Samson Mow, the former Blockstream chief strategy officer who has been providing regular updates on the recovery, said Liquid transactions were once again processing normally.
Mow noted that L-BTC is currently only about 85% backed while the approximately 598 BTC remains outstanding.
Leaving the door open
Bitcoin's defining characteristic is that its transaction history is permanently recorded on a public blockchain.
"Transactions do not disappear, and neither does the evidence they leave behind," the company warned.
Blockstream left the door open for the attackers to return the remaining coins without further escalation.
"There is still an opportunity to resolve this responsibly," the company said.
