Blockstream is drawing a hard line after the Liquid breach. Nearly 4,000 $BTC were drained from Liquid’s reserves. The attackers have already returned around 3,400 BTC, roughly 85% of the stolen funds. They still control 598.5 BTC, worth about $47 million, and are asking for a 10% bounty before releasing the remaining funds. Blockstream has rejected that demand and is treating the case as theft. Its position is simple: taking assets without authorization, then holding part of them while requesting payment for their return, falls outside any credible definition of white-hat activity. The company now plans to involve law enforcement, exchanges and blockchain-tracing specialists to follow the remaining funds and identify the people behind the breach. The attackers continue to describe themselves as white hats, but the unresolved 598.5 $BTC remains the key issue. At this point, the debate is less about the label and more about what happens to the remaining $47 million.