Blockstream said it will not "pay a ransom" for the return of about 598.5 BTC still held after the Liquid exploit.
The hackers returned 3,400 BTC on Monday, about 85% of what was taken.
The company said it will work with law enforcement, exchanges and forensic specialists to trace the rest should it not be returned.
Blockstream has refused to pay for the return of the $47 million in Bitcoin still missing from the Liquid Network, abandoning days of negotiation with the people who took it.
"Taking assets without authorization and withholding their return is a crime, not responsible disclosure," the companysaid on Friday. "It is not white-hat activity. It is theft."
To those responsible for the theft of bitcoin from the Liquid Network:
Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is…
Around 4,000 BTC wasdrained from the sidechain on Sunday, worth about $320 million. The attackersreturned 3,400 BTC on Monday, leaving598.5 BTC at the address they withdrew to, where it remains unmoved.
A flaw in how Liquid nodes cache range proof verifications let the attackers mint unbacked L-BTC and swap it for reserve Bitcoin through SideSwap, a federation member holding a peg-out authorization key. The reserve fell to 197 BTC. Blockstream patched the bridge nodes within ten hours and shipped Elements v23.3.4 on Wednesday. Liquidresumed producing blocks and processing transactions Thursday, though peg-outs stay disabled as a precaution while "the final stage of recovery" continues. It warned separately of scammers targeting node operators with fake update sites.
Tuesday's incidentreport from Liquid struck a different tone, saying it was coordinating "with the white hat hacker" to restart the network.
Its participation in those talks "should not be mistaken for acceptance of the actions taken nor of the terms being demanded," Blockstream said. Those terms were public. In a Bitcoin transaction on Wednesday, the exploiterswrote that Blockstream had allocated "only $1.5M (maybe even 0) to secure $5B assets," calling it "a flagrant neglect of security." They wanted 10% "using your own money as bug bounty," or "you will cause all your holders a 15% loss for your irresponsibility and stinginess."
Blockstream will not be "a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation," it said.
Nor will it cover the shortfall from users. "Bitcoin is hard money and can't be minted without costs," it said. "Bitcoin doesn't haircut users to pay a ransom."
Instead it will pursue "every lawful avenue" with law enforcement, exchanges and forensic specialists, should the funds not be returned. "Transactions do not disappear, and neither does the evidence they leave behind," it warned, closing: "Return the bitcoin."
Start every day with the top news stories right now, plus original features, a podcast, videos and more.