- White-hat Hackers returned 3,400 Bitcoin (~$270 million) to the Liquid Federation wallet.
- The original withdrawal of ~4,000 BTC (~$320 million) exploited a bug in Elements software.
- Blockstream patched the vulnerability; about 598 BTC remains outstanding.
- The actors negotiated via onchain messages and identified as white hats.
- Liquid network remains paused as federation prepares for a coordinated restart.
On Monday, purported white-hat hackers returned 3,400 Bitcoin worth approximately $270 million to the Liquid Federation wallet after withdrawing roughly $320 million from the Bitcoin sidechain’s reserves. The return followed confirmation from Blockstream that the affected bridge nodes had been patched, according to JAN3 CEO and former Blockstream executive Samson Mow said.
The original Sunday security incident saw hackers withdraw about 4,000 BTC from the wallet’s roughly 4,200 BTC. Onchain records show that exactly 3,400 BTC was transferred back to the federation’s address.
Blockstream said updated software had been deployed and federation members were preparing for a coordinated restart. The return of about 85% of the withdrawn Bitcoin restores much of the backing removed in the incident.
The original withdrawal was processed through SideSwap’s Peg-out Authorization Key, though Liquid and SideSwap said the key itself was not compromised. SideSwap said the L-BTC involved originated from a bug in Elements, the open-source software underpinning Liquid.
Blockstream contacted the actors through signed messages embedded in Bitcoin transactions. The actors, who identified themselves as white hats, said they would return most of the funds once the vulnerability was fixed and every node had installed the patch.
Mow said Liquid remained paused while Blockstream and federation members made further fixes, resolved a chain split and prepared for a safe restart. He told users not to send Bitcoin to Liquid peg-in addresses until the network’s restart is confirmed.
Ledger chief technology officer Charles Guillemet questioned the actors’ white-hat description after the partial return. He said that if the roughly 600 BTC still under their control represented a reward negotiated through encrypted onchain communications, the arrangement looked “more like extortion than white-hat Hacking.”
Neither Blockstream nor Liquid publicly described the outstanding Bitcoin as a bounty or disclosed any repayment terms. Cointelegraph reached out to both companies for comments but did not receive a response before publication.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
