The actors behind Liquid’s 4,000 BTC security incident returned 3,400 BTC to the federation wallet.
The transfer followed a signed message from Blockstream saying Liquid’s bridge nodes had been patched.
Nearly 600 BTC remains outstanding, and Liquid has not announced when normal operations will resume.
The self-proclaimed “white hat hackers” behind the withdrawal of roughly 4,000 BTC from Liquid Network returned 3,400 BTC, worth around $269.2 million, to the sidechain’s federation wallet Monday, recovering about 85% of the funds.
The incident began Sunday when a customer sent 4,000 L-BTC to SideSwap’s peg-out service. The actors later called themselves “whitehats”—ethical hackers who identify security flaws to help organizations fix them—in a Bitcoin transaction message.
Ledger Chief Technology Officer Charles Guillemet remained skeptical of the actors’ white-hat claim after most of the funds were returned.
“So, 3,400 BTC were refunded,” Guillemet wrote on X. “The ‘white hats’ still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!”
Liquid disabled its bridge nodes after the withdrawal and asked exchanges to suspend L-BTC deposits and withdrawals.
The return leaves Liquid with nearly 600 BTC still outstanding. The network has not said whether those coins will be returned, how it will cover any remaining gap in L-BTC backing, or when the sidechain and its peg services will resume normal operations.
BitcoinBTC · USD
$78,799−1.17%
03:30 AM09:30 AM03:30 PM09:15 PM03:15 AM
$79.9k$79.5k$79.1k$78.8k
24h HighHigh$79,950
24h LowLow$78,707
VolVol$856.5M
Market projectionsOdds by Myriad
The return followed a series of messages exchanged with Blockstream, the developers of the Liquid sidechain, and the hackers through Bitcoin transactions.
“Please fix the bug first,” the actors wrote. “The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
Blockstream later sent a signed message stating, “Bridge nodes are patched, safe to return the funds.”
The actors then transferred 3,400 BTC to the Liquid Federation address. They had previously offered to return “most” of the Bitcoin but have not publicly explained why they kept the remainder.
Blockstream did not immediately respond to a request for comment by Decrypt.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
