The individuals behind the recent Liquid Network incident involving the withdrawal of 4,000 BTC have returned 3,400 BTC, valued at approximately $269.2 million, to the network’s federation wallet. This action has enabled the recovery of about 85% of the affected funds, but nearly 600 BTC, worth around $47 million, remains unaccounted for.
White hat claims and skepticism
The episode began when a Liquid customer initiated a transaction, sending 4,000 L-BTC using SideSwap’s peg-out service. The parties responsible for the withdrawal identified themselves as “white hats,” claiming their actions were undertaken to expose security weaknesses within the sidechain’s infrastructure.
Through a message embedded in a Bitcoin transaction, the group described their intentions as ethical, stating their aim was to help secure the network and ensure vulnerabilities were addressed before returning the assets.
“Please fix the bug first,” the individuals informed Blockstream, the developers behind Liquid. “The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
Despite these claims, not all industry voices were convinced about the white hat nature of the operation. Charles Guillemet, Chief Technology Officer at Ledger, expressed doubts regarding the hackers’ motives after the majority of the funds were sent back. He pointed out that keeping 600 BTC resembled extortion rather than a genuine act of security research.
Guillemet noted, “So, 3,400 BTC were refunded. The ‘white hats’ still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!”
Security response and ongoing uncertainty
Following the incident, Liquid promptly disabled its bridge nodes and requested partner exchanges to suspend deposits and withdrawals of L-BTC. The return of funds occurred only after Blockstream confirmed via a signed message that all bridge nodes had been patched and were secure for further transactions.
The group had previously stated they would return “most” of the tokens, but have not provided public justification for the retained BTC. At this stage, Liquid has not announced when it will resume regular operations, restore the peg services, or clarify how the remaining gap in L-BTC collateral will be addressed.
Conversations between Blockstream and the actors were conducted via messages on the Bitcoin blockchain, culminating in the phased return of assets to the Liquid Federation address. Blockstream has yet to release a detailed statement regarding the unresolved portion of BTC or future plans for the sidechain’s restoration.
Market tools for uncertain times
Given how quickly incidents or interventions, such as a sudden Fed decision or an unexpected major altcoin listing, can reshape the entire landscape, tracking real-time data across separate platforms can lead to missed opportunities for market participants. Many investors are now turning to privacy-focused solutions like CryptoAppsy, which offer real-time charts, instantaneous price alerts, concise coin news, and essential macroeconomic information in one interface, without requiring users to register or create an account. This approach streamlines monitoring and can help protect traders from the type of rapid developments demonstrated by the Liquid incident.
