The group known as “white hat” hackers returned 3,400 bitcoin to the Liquid Network federation wallet on Monday, one day after withdrawing nearly 4,000 BTC using an exploit in the platform. Approximately 598.5 BTC, representing about 15% of the funds, remained with the white hats as an implied bounty, currently valued at $48 million.
Timeline of the incident
The withdrawal of around 4,000 BTC occurred on Sunday from the federation wallet of Liquid Network. This prompted immediate attention, as Liquid, a Bitcoin sidechain developed and maintained by Blockstream, plays a significant role in providing faster Bitcoin settlements and confidential transactions for exchanges and traders.
Mini dictionary: Liquid Network, a Bitcoin sidechain managed by Blockstream, allows quicker transactions between exchanges and offers confidential transfer features while utilizing a federation of trusted members to secure its network.
Shortly after the incident, a series of public messages were exchanged on the Bitcoin blockchain using the OP_RETURN field, a protocol feature that enables users to embed arbitrary data within transactions. The white hats’ first message instructed the federation to contact them on-chain, identifying themselves as the holders of the 4,000 BTC.
Negotiations and response
Blockstream, the company behind Liquid Network, responded with their own messages, including email contact information and, later, communications carrying Electrum-encrypted payloads and PGP signatures verifiable against the company’s published security key. In one message, the white hats inquired if returning “most” of the funds would be acceptable. Another message insisted that Blockstream patch a vulnerability affecting Liquid’s chain, stating that all nodes should be updated before any funds could be safely returned.
As proof of progress, Blockstream posted a clear-text update reading, “Bridge nodes are patched, safe to return the funds.” Minutes after this, the white hats sent 3,400 BTC back to the network’s designated peg script address. The remaining 598.5 BTC stayed at the hacker’s address as a finder’s fee.
| Action | Amount (BTC) | Recipient | Estimated Value |
|---|---|---|---|
| Returned to Liquid | 3,400 | Federation wallet | Current BTC price x 3,400 |
| Kept by white hats | 598.5 | White hat address | ~$48 million |
Discussion about the returned amount spread swiftly on social media, with some community members expressing relief over the recovery and others voicing concern about the sizable bounty. Four additional encrypted messages appeared on-chain from Blockstream following the return, suggesting that negotiations regarding the finder’s fee were ongoing and perhaps contentious.
Aftermath and ongoing talks
The dialogue between Blockstream and the white hats continued through encrypted on-chain messages. The final public response from the white hats was a simple sad face emoji, which many interpreted as disappointment over the unresolved bounty dispute. No further public details about the content of these encrypted messages have been released, and Blockstream has yet to issue an updated statement regarding the returned BTC.
Community researchers, including contributors from GitHub and Galaxy Research, have closely tracked the negotiation process and the on-chain activity. According to a previous statement from SideSwap, an Elements protocol bug facilitated the exploit, though no other assets issued on Liquid were affected and the network was paused following the withdrawal.
As of now, the latest official communication from Liquid remains Sunday’s post, confirming that white hats withdrew about 4,000 BTC via SideSwap, the PAK was not compromised, and only L-BTC was impacted.
Shortly after Blockstream confirmed that all bridge nodes were patched and the network was safe, the white hats returned 3,400 BTC to the federation, retaining a 15% finder’s fee worth tens of millions of dollars.
