Listen: the breakdown
Developing story update (September 12, 2026, 01:38 UTC):
New detail on the scale of the incident: the original Liquid Network exploit drained roughly 4,000 BTC, valued at about $320 million at the time. Based on our sources, most of those funds have since been returned, leaving close to 600 BTC still held by the attackers.
On the operational side, the Liquid Network has restarted block production, a sign the chain is functioning again while recovery efforts continue. Blockstream is maintaining its refusal to pay any ransom and says it will pursue recovery with law enforcement, exchanges, and forensic specialists.
What to watch now: Whether the remaining roughly 600 BTC moves or gets recovered, and any further official recovery updates.
Developing story update (September 12, 2026, 00:32 UTC):
New context on scale: the initial breach of the Liquid Network is now put at roughly 4,000 BTC, valued at about $320 million, based on our sources. That reframes the near 600 BTC still held by the attackers as the remaining, unrecovered slice of a much larger theft rather than the full loss.
For traders the read is unchanged. The dollar figure is larger than first framed, but it is still small relative to total Bitcoin liquidity, and price action has stayed flat with BTC near $77,281 and roughly +0.6% on the day. This remains a network-integrity story, not a probable market catalyst, and it does not alter the higher timeframe outlook.
What to watch now: Watch for any confirmed recovery of the initial ~4,000 BTC or a named exchange or law-enforcement action, which would be the real catalyst.
Developing story update (September 11, 2026, 22:42 UTC):
Our sources confirm that the Liquid Network hack initially involved 4,000 BTC, a significantly larger sum than the currently reported 600 BTC. Crucially, most of these funds have already been returned, indicating a partial resolution to the incident.
Blockstream continues to reject the ransom demand for the remaining nearly 600 BTC, maintaining its stance against paying attackers and committing to work with law enforcement and forensic specialists for recovery.
Despite this new context, Bitcoin’s price has shown minimal reaction, suggesting the market views the remaining unrecovered amount as contained and not a significant systemic risk.
What to watch now: Monitor for further recovery efforts or any movement of the remaining 600 BTC.
Developing story update (September 11, 2026, 22:18 UTC):
Blockstream has now confirmed its firm stance against the Liquid Network hackers, publicly communicating its rejection of the ransom demand on social media platform X on September 11, 2026. This reiterates their commitment to not negotiate with the attackers.
The situation remains largely unchanged regarding the stolen assets, with nearly 600 BTC still held by the exploiters. Blockstream continues its stated intention to collaborate with law enforcement, exchanges, and forensic specialists for recovery efforts.
Despite this ongoing security incident, Bitcoin’s price continues to show negligible reaction, reinforcing our view that the market considers this a contained event with no broader impact on macro trends or smart money positioning.
What to watch now: Traders should monitor for any further updates on recovery efforts or new communication from Blockstream regarding the stolen funds.
Developing story update (September 11, 2026, 21:36 UTC):
Our sources confirm the Liquid Network exploit does not qualify as white-hat hacking. This clarifies the malicious intent behind the attack, reinforcing Blockstream’s decision to reject any ransom or bounty.
What to watch now: Monitor for further details on law enforcement efforts and any recovery progress.
Developing story update (September 11, 2026, 20:31 UTC):
Blockstream has now officially classified the recent Liquid Network exploit as theft, explicitly stating it does not qualify as white-hat hacking. This clarification reinforces their firm stance against paying any ransom or bounty to the perpetrators.
The hackers continue to hold nearly 600 BTC, with Blockstream maintaining its commitment to work with law enforcement and forensic specialists for recovery. The Liquid Network’s block production remains operational.
This official designation as theft underscores the company’s resolve, signaling a continued pursuit of recovery rather than negotiation. Traders should note this firm position as it shapes the ongoing response to the incident.
What to watch now: Monitor Blockstream's recovery efforts and any further statements regarding the classification of the exploit.
Developing story update (September 11, 2026, 19:48 UTC):
Blockstream has confirmed it refused a specific 10% bounty offered by the Liquid Network exploiters, reinforcing its stance against any ransom payment. This clarifies the nature of the rejected demands.
In a significant operational development, the Liquid Network has successfully restarted block production. This indicates progress in restoring the network’s functionality following the exploit.
What to watch now: Traders should monitor for any further updates on the recovery of funds and the full operational stability of the Liquid Network.
Developing story update (September 11, 2026, 18:43 UTC):
New information reveals the Liquid Network exploit initially drained 4,000 BTC, a much larger sum than the approximately 598-600 BTC currently held by the hackers.
This significant difference suggests that a substantial portion of the initially stolen funds, over 3,400 BTC, has either been recovered or moved from the hackers’ control since the exploit occurred.
Blockstream continues to reject ransom demands and is actively collaborating with law enforcement, exchanges, and forensic specialists to recover the remaining Bitcoin.
What to watch now: Monitor for updates on the 3,400+ BTC difference between initial drain and current hacker holdings.
Developing story update (September 11, 2026, 17:19 UTC):
Blockstream has further clarified its position on the Liquid Network exploit, stating that the incident does not qualify as white-hat hacking. This reinforces the company’s firm rejection of any ransom or bounty demands from the hackers.
What to watch now: Monitor for any further communication from Blockstream regarding law enforcement actions or potential recovery efforts.
Developing story update (September 11, 2026, 16:56 UTC):
Fresh detail sharpens the scale of the Liquid Network incident. Based on our sources, the exploit initially drained around 4,000 BTC, with the total value of the hack reported near $320 million. The roughly 598 BTC the attackers still hold is the portion outstanding after earlier recovery.
Blockstream has also declined a 10% bounty the attackers offered, reinforcing its refusal to treat this as white-hat activity. The company says it will keep working with law enforcement, exchanges, and forensic specialists to pursue recovery if the funds are not returned.
For traders this stays a headline-risk item rather than a structural one. Bitcoin is holding near $77,900 with mixed short-term action, and there is no confirmed sign this incident is forcing broad selling or a systemic liquidity event.
What to watch now: Whether any of the outstanding ~598 BTC moves on-chain or is frozen at an exchange.
Developing story update (September 11, 2026, 16:12 UTC):
Blockstream has added a further clarification on the Liquid Network exploit, stating the incident does not qualify as white-hat hacking. That framing matters: it signals the company is treating the roughly 598 BTC still held by the attackers as a criminal theft rather than a good-faith security disclosure, which typically hardens the path toward law enforcement and forensic recovery over any negotiated return.
For traders the takeaway is unchanged in scale. The amount involved remains small relative to broader market liquidity, and this looks like an isolated event rather than a systemic catalyst. Bitcoin continues to trade in the high $77,000s with a slight intraday dip, more consistent with the prevailing cautious tone than a direct reaction to this news.
What to watch now: Whether Blockstream's non-white-hat stance leads to a named law-enforcement or exchange freeze action on the held BTC.
Developing story update (September 11, 2026, 15:25 UTC):
New detail on the scale of the incident: based on our sources, the original Liquid Network exploit drained roughly 4,000 BTC, far larger than the amount still in the attackers’ hands. The portion the hackers are still holding is now put at approximately 598.5 BTC, consistent with the earlier ‘nearly 600’ figure.
The gap between the two numbers implies a meaningful share of the drained coins has already moved or been recovered. Blockstream’s position is unchanged: no ransom, and cooperation with law enforcement, exchanges, and forensic specialists to pursue what remains. Bitcoin’s price reaction stays muted, so we continue to read this as an isolated sidechain security event rather than a broad market catalyst.
What to watch now: Whether the ~3,400 BTC gap between the 4,000 drained and the 598.5 still held gets confirmed as recovered, frozen, or laundered.
Developing story update (September 11, 2026, 14:30 UTC):
Blockstream Refuses Ransom for Return of $47M in Bitcoin from Liquid Hack: 'It Is Theft'. With 598.5 BTC still outstanding, the company says it will go to law enforcement should the funds not be returned.
Developing story update (September 11, 2026, 13:54 UTC):
Fresh detail on the scale of the September 6 Liquid Network exploit: the attack initially drained roughly 4,000 BTC, valued at approximately $320 million, before the hackers narrowed their hold to the nearly 600 BTC they are now using as ransom leverage. The figure reframes this as one of the larger Bitcoin sidechain incidents of the cycle.
On the recovery side, the Liquid Network has restarted block production, meaning the sidechain is operational again while Blockstream works with law enforcement, exchanges, and forensic specialists to pursue the stolen funds. Based on our sources, Blockstream maintains its refusal to pay and does not regard the incident as white-hat.
What to watch now: Watch whether any of the ~4,000 BTC or the 598 BTC ransom stash begins moving to exchanges, a sign recovery talks have collapsed.
Developing story update (September 11, 2026, 11:57 UTC):
Blockstream has now added detail to its position on the Liquid Network exploit: alongside refusing to pay any ransom, the company says it intends to pursue lawful avenues to recover the funds still held by the attackers. This signals the matter is moving toward a legal and law-enforcement track rather than a negotiated settlement.
For traders the practical read is unchanged. Roughly 598.5 BTC remains under the attackers’ control after around 3,400 BTC was returned earlier, an amount that stays small against total market depth. Price action is muted, with BTC near $76,959 and down about 1.2 percent on the day, so this is unlikely to be a standalone catalyst.
What to watch now: Any formal legal filing or law-enforcement action, or renewed movement of the roughly 598.5 BTC still held.
Developing story update (September 11, 2026, 10:30 UTC):
Beyond refusing the ransom, the company has now outlined how it intends to chase the roughly 598.5 BTC still held by the attackers. Based on our sources, it plans to work with law enforcement, exchanges, and forensic specialists to trace and recover the funds.
For traders, this signals a coordinated recovery push rather than a quiet write-off, and it raises the odds that the disputed coins get flagged or frozen if they touch major venues. Price action stayed muted, with BTC near $77,000 and little direct reaction so far.
What to watch now: Watch major exchanges for any freeze or flagging of the roughly 598.5 BTC still held by the attackers.
Market briefing: Blockstream has refused to pay a ransom for the Bitcoin still held by the Liquid Network attacker, roughly 598.5 BTC. Bitcoin sat near $77,335, down about one percent on the day, with the story barely moving price.
- Blockstream refused the ransom for nearly 600 BTC still controlled by the Liquid Network attacker.
- About 3,400 BTC was already returned earlier this week; the firm rejects the white-hat label.
- BTC traded near $77,335, down roughly 1% in 24h, as the broken $77,700 support sets the real story.
Blockstream refused a ransom while hackers still hold nearly 600 BTC from the Liquid Network exploit. So does this principled stand actually move Bitcoin, or is the real story somewhere else?
Blockstream has drawn a hard line. Today, September 11, 2026, the company said it will not pay a ransom for the Bitcoin still held by the actor behind the Liquid Network exploit. Roughly 598.5 BTC, close to 600 coins, remains under that attacker's control.
Earlier this week, about 3,400 BTC was returned. That partial return might tempt some to call the incident a white-hat rescue. Blockstream disagrees, and firmly. It does not view this as ethical hacking, and it will not reward the behaviour by negotiating.
Instead, the firm says it will pursue lawful avenues. It plans to work with law enforcement, exchanges, and forensic specialists to trace and recover the remaining coins. In crypto, refusing to pay is still the exception rather than the rule, which is precisely why the stance stands out.
Here is the part that matters for traders. The market shrugged. Bitcoin traded near $77,335, down about one percent over 24 hours, and up a fractional 0.2% on the hour. A hack headline that barely dents price is telling you something.
The stolen amount is small against Bitcoin's daily flows. Most of the funds are already back. So the news reads as principle, not catalyst. The tape was busy long before this post, and it stayed busy after. Traders chasing the drama here are watching the wrong screen.
A principled stand with no macro weight
This story matters mostly for what it does not do. A refused ransom is a governance and reputation event, not a monetary one. It changes no supply schedule, no liquidity condition, and no rate expectation.
Trace the chain honestly. Blockstream rejects the ransom, which is minor security news, which produces no macro effect, which triggers no direct liquidity shift. BTC, ETH, and alts keep following the broader structure, not this headline.
The transmission simply is not there. Roughly 598.5 BTC is a rounding error against the volume Bitcoin turns over in a single session. The bulk of the stolen coins, about 3,400 BTC, already returned. So there is no fresh sell pressure hanging over the market from this event.
There is a second-order point worth naming. Refusing to negotiate removes the incentive to steal for profit, which is structurally healthy for the ecosystem over time. But structural health and next-week price are different questions.
Retail may latch onto the word hack and expect a reaction. The near-flat tape says the smart flows already priced this as noise. When a security headline lands and nothing moves, that stillness is the signal. So we treat this cleanly. It is a confirmed fact worth reporting, and a footnote in the driver that actually rules the market right now: a broken support and a crowd leaning the wrong way.
Broken $77,700 support leads the tape
The real driver sits in the chart, not the ransom note. Bitcoin lost the $77,700 medium-term support and traded near $77,335 as of the latest read. That break, not the exploit, is what sets the tone across the market.
Lead with BTC. A confirmed loss of a key support tends to invite continuation, not celebration. With price now under that shelf, the path of least resistance points lower on the higher timeframes we weight most.
ETH inherits this posture. Ethereum has no independent bid strong enough to fight a leaking Bitcoin here. When BTC leads down through support, ETH usually follows with a slightly wider swing.
Alts sit at the end of the whip. They amplify Bitcoin's moves in both directions, so a deeper BTC correction typically drains alt liquidity fastest. This is the mechanical order: BTC first, then ETH, then the long tail.
The Liquid story adds nothing to this cascade. It moved no coins onto exchanges in size and created no forced selling. So the liquidity picture is unchanged by it.
What is changed is trader psychology. Fear from a hack headline, layered on a broken support, nudges nervous holders toward the exit at exactly the wrong moment. That is how weak hands become someone else's cheaper entry. The tape rewards the patient and taxes the reactive, as it usually does.
Below $58,000 confirms, $82k reclaim invalidates
Watch the levels, not the headlines. With $77,700 broken, the next meaningful line is the previous low near $58,000. A decisive move below it would confirm the bearish structure and open the door toward the deeper zone.
That deeper zone is $55,000 to $44,000, with $44,000 as the lower boundary. We view it as an exchange of hands area, where patient capital tends to meet capitulating sellers. Reaching it is the scenario we weight, not a promise.
Invalidation is just as important, and cleaner to define. A reclaim of the $82,000 to $88,000 resistance band would flip the bias. Until that happens, rallies into it are suspect rather than trend changes.
We are also tracking the daily divergence. Price printed higher highs while volume printed lower highs, a bearish divergence that warns rallies lack fuel. On the historical NUPL model, lower lows against equal price lows hint at quiet supply absorption underneath.
On the Liquid case itself, watch whether the remaining 598.5 BTC moves. Any large transfer toward exchanges would be worth noting, though the amount is too small to reshape the trend.
The short-term wildcard is a possible push higher to complete a C-wave structure on the four-hour chart. That would be a relief bounce inside a bearish frame, not a reversal, unless the $82k to $88k band actually gives way.
Why the crowd's long bets fuel the drop
The ParadiseTeam frames this security story as background, because the tape is telling a clearer tale. With Bitcoin near $77,335 and the $77,700 support already lost, the structure, not the ransom, sets our read.
Here is the mechanism we are watching. Retail is stacking leveraged long positions into weakness, convinced the bottom is in. Those longs are fuel. They sit as liquidity that a downside squeeze can hunt on the way to lower prices.
Smart money, meanwhile, is not chasing. Whale USDT reserves have not rotated into crypto yet. That patience usually precedes accumulation at capitulation, not at broken supports on the way down.
So we read the Liquid headline as noise that does not alter positioning. A refused ransom over 600 coins does not move a market this size. Trading it as a catalyst would be reacting to theatre while the real level breaks quietly.
Our zone of interest remains $55,000 to $44,000, ideally after price loses the $58,000 low. That is where we expect the exchange of hands, where sidelined capital tends to absorb the panic.
The bias flips only on a reclaim of $82,000 to $88,000. Below that band, we treat bounces as relief inside a bearish frame. Discipline over drama: manage risk to the level, size to survive being wrong, and let the impatient supply the liquidity.
The read behind this: we framed this story through our own market analysis, Can Bitcoin Hold This Support?
Track it live: our live crypto funding rates and the Crypto Fear and Greed Index both update in real time, so you can watch this shift for yourself.
Related coverage
For exact entries, targets, and stop losses with full risk management, that is what ParadiseFamilyVIP is for. New to reading these moves? Start with our crypto trading strategies guide.
ParadiseTeam is monitoring the market situation closely, and we are taking these developments into consideration while building our trading tactics inside ParadiseFamilyVIP.
Crypto trading involves substantial risk. Prices are volatile and you can lose money. This article is educational and is not financial advice. Past performance does not guarantee future results.
Join the discussion 1
600 BTC is a lot... but on a wider scale, the macro environment and dollar liquidity flows are still the drivers I'm watching more closely.