White‑hat actors return $270 million in Bitcoin to Liquid as network prepares restart
White‑hat actors return most of the stolen Bitcoin
Three thousand four hundred Bitcoin (about $270 million) was sent back to the Liquid federation wallet after a security breach that had withdrawn roughly 4,000 BTC from the sidechain’s reserves.
Key numbers
- 85 % of the withdrawn Bitcoin (3,400 BTC) has been returned.
- About 598 BTC (≈$50 million) remains unreturned.
- Blockstream patched the affected bridge nodes before the return.
- Liquid’s L‑BTC token is backed by Bitcoin held in the federation wallet.
Official comment from Liquid
Liquid CEO Samson Mow, a former Blockstream executive, posted on X that the return came after Blockstream confirmed the bridge nodes were patched. He noted that 598 BTC is still outstanding and that Blockstream continues to work with the actors.
Additional details from involved parties
Blockstream said updated software had been deployed and that federation members were preparing for a coordinated restart of the network. SideSwap, which processes peg‑out transactions, said the withdrawal used its Peg‑out Authorization Key, but the key itself was not compromised. SideSwap also traced the issue to a bug in Elements, the open‑source software that underpins Liquid.
Ledger’s chief technology officer Charles Guillemet questioned the “white‑hat” label, suggesting that the remaining 598 BTC might be a negotiated reward, which could resemble extortion rather than a benevolent hack.
What is confirmed
- On‑chain records show a transaction moving exactly 3,400 BTC back to the federation wallet.
- The original breach removed about 4,000 BTC from a wallet that held roughly 4,200 BTC.
- Blockstream has deployed a software patch to the bridge nodes.
- Liquid’s network remains paused while further security fixes are applied.
Unresolved questions
- The status of the remaining 598 BTC is unclear; no public terms for its return have been disclosed.
- Whether the actors’ “white‑hat” claim reflects a genuine security effort or a negotiated payoff is debated.
Why this matters
Liquid issues L‑BTC, a token that represents Bitcoin locked in its federation. Returning most of the stolen Bitcoin restores the backing for L‑BTC and helps rebuild confidence in the sidechain’s security, which is necessary before the network can restart.
Next steps for the network
Liquid will stay paused until Blockstream and federation members complete additional fixes, resolve a chain split, and ensure all nodes have the patch. Users are advised not to send Bitcoin to Liquid peg‑in addresses until the restart is officially confirmed.
