Purported white-hat hackers have returned 3,400 Bitcoin, valued at approximately $270 million, to the Liquid Federation wallet after withdrawing roughly $320 million from the Bitcoin sidechain’s reserves.
Return Follows Security Patch Confirmation
On Monday, JAN3 CEO and former Blockstream executive Samson Mow confirmed the return occurred after Blockstream verified that affected bridge nodes had been patched. Mow noted that approximately 598 BTC remains outstanding and that Blockstream continues to engage with the actors involved.
The development follows a Sunday security incident in which hackers withdrew about 4,000 BTC from the wallet’s roughly 4,200 BTC holdings. Onchain records confirm that exactly 3,400 BTC was transferred back to the federation’s wallet address.
Blockstream stated that updated software had been deployed and federation members were preparing for a coordinated restart. Because Liquid issues L-BTC against Bitcoin held by its federation, the return of approximately 85% of the withdrawn Bitcoin restores much of the backing removed during the incident as the paused network prepares to resume operations.
Onchain Negotiations Preceded Bitcoin Return
The original withdrawal was processed through SideSwap’s Peg-out Authorization Key, though both Liquid and SideSwap maintained the key itself was not compromised. SideSwap attributed the L-BTC involved to a bug in Elements, the open-source software underpinning Liquid.
Blockstream contacted the actors through signed messages embedded in Bitcoin transactions. The actors, who identified themselves as white hats, said they would return most of the funds once the vulnerability was fixed and every node had installed the patch.
Mow said Liquid remained paused while Blockstream and federation members made further fixes and security improvements, resolved a chain split and prepared for a safe restart. He told users not to send Bitcoin to Liquid peg-in addresses until the network’s restart is confirmed, adding that no user action was otherwise required.
Industry Figure Questions ‘White Hat’ Characterization
Ledger chief technology officer Charles Guillemet questioned the actors’ white-hat description after the partial return. He said that if the roughly 600 BTC still under their control represented a reward negotiated through encrypted onchain communications, the arrangement looked ‘more like extortion than white-hat hacking.’
Neither Blockstream nor Liquid publicly described the outstanding Bitcoin as a bounty or disclosed any repayment terms. Cointelegraph reached out to both companies for comments but did not receive a response before publication.
