- Hackers claiming to be white hats withdrew nearly 4,000 BTC from Liquid Network on September 6, then returned 3,400 BTC the next day.
- The remaining 598.5 BTC, valued at about $47 million, remains in the attacker’s address as of September 8.
- Blockstream says the peg-out key was not compromised; a bug in the Elements software allowed the exploit.
- Ledger’s CTO rejected the white‑hat label, calling the arrangement extortion.
On September 6, hackers claiming to be white hats withdrew nearly 4,000 bitcoin from the Liquid Network, a Bitcoin sidechain that holds real bitcoin to back the token L‑BTC. The next day, they returned 3,400 bitcoin—worth roughly $265 million—to a Liquid Federation address, according to Bitcoin’s public record.
The remaining 598.5 bitcoin, valued at about $47 million, sits in the attacker’s original address as of September 8, according to mempool.space. This amount is the change from the same transaction, not a separate payment.
Blockstream, the technology provider for Liquid, stated in an incident notice that the withdrawal took about 95% of Liquid’s reported bitcoin reserves. The funds were removed via SideSwap’s Peg‑out Authorization Key, which was not compromised, Blockstream said. “A bug in Elements,” the software Liquid runs on, created the L‑BTC used in the withdrawal, according to Unchained.
The hackers communicated on the Bitcoin blockchain, writing messages like “we are whitehats. contact us on chain,” The Block reported. They demanded the flaw be fixed and nodes patched before returning funds. Blockstream replied with a signed message confirming patching, and the return followed via a transaction that included a PGP‑encrypted message.
However, not everyone accepts the white‑hat description. Charles Guillemet, chief technology officer at Ledger, rejected the label, Unchained reported. He said that if the roughly 600 bitcoin still held was a reward negotiated via encrypted messages, the arrangement looked more like extortion. As of September 8, Blockstream’s status page still listed the incident as active, with public bridge nodes down. The network remains paused, preventing L‑BTC holders from redeeming their tokens.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
