The actors returned 85% of the Bitcoin withdrawn from Liquid’s federation wallet after the security incident.
Purported white-hat hackers returned 3,400 Bitcoin, worth roughly $270 million, to the Liquid Federation wallet after withdrawing about $320 million from the Bitcoin sidechain’s reserves.
On Monday, JAN3 CEO and former Blockstream executive Samson Mow said the return came after Blockstream confirmed that patches had been applied to the affected bridge nodes. He added that about 598 BTC remains outstanding, while Blockstream continues to engage with the actors.
The return came after a Sunday security breach in which hackers withdrew around 4,000 BTC from the wallet’s estimated 4,200 BTC reserves. Onchain data shows that exactly 3,400 BTC has since been transferred back to the federation’s wallet address.
Blockstream said it had deployed updated software, while federation members prepared for a coordinated restart. Liquid issues L-BTC against Bitcoin held by its federation, meaning the return of roughly 85% of the withdrawn BTC restores much of the backing affected by the incident as the paused network moves toward resuming operations.
Bitcoin Return Follows Onchain Negotiations
The initial withdrawal was processed through SideSwap’s Peg-out Authorization Key, but both Liquid and SideSwap said the key itself had not been compromised. SideSwap said the L-BTC involved stemmed from a bug in Elements, the open-source software that underpins the Liquid network.
Blockstream reached out to the actors through signed messages embedded in Bitcoin transactions. The group, which identified itself as white hats, said most of the funds would be returned after the vulnerability was fixed and all nodes had installed the required patch.
Mow said Liquid remained paused as Blockstream and federation members carried out additional fixes and security upgrades, resolved a chain split and worked toward a safe restart. He advised users not to send Bitcoin to Liquid peg-in addresses until the network officially confirms its restart, while noting that no other user action was required.
Ledger Chief Technology Officer Charles Guillemet questioned the actors’ white-hat claim following the partial return. He said that if the roughly 600 BTC still in their possession represented a reward negotiated through encrypted onchain communications, the arrangement appeared “more like extortion than white-hat hacking.”
Neither Blockstream nor Liquid publicly characterized the remaining Bitcoin as a bounty or revealed details about any repayment agreement.
