The white‑hat group that had withdrawn roughly 4,000 BTC from the Liquid Network federation wallet on Sunday returned 3,400 BTC to the wallet on Monday. Approximately 598.5 BTC, representing about 15% of the total amount, remained at the original address as an implied bounty worth roughly $48 million.
The transaction (bc49a46d), confirmed at 16:09 UTC on September 7, transferred exactly 3,400 BTC back to the Liquid peg‑script address and returned the remaining 598.5 BTC to the white‑hat hacker’s address as change.
The transfer followed a day of on‑chain messages. The white‑hats first posted a transaction containing an OP_RETURN message reading “contact us on chain,” originating from the address that held the 4,000 BTC taken from Liquid.
A Blockstream‑affiliated address responded with “Please contact [email protected]”. Subsequent communications from that sender were delivered via Electrum‑encrypted payloads and PGP signatures, which can be verified against Blockstream’s published security key.
In block 965869, the white‑hats asked in plain text whether returning “most” of the funds to the federation script was acceptable. The 1,000‑sat output served solely as a data carrier.
Shortly thereafter, they wrote, “Please fix the bug first. The chain is vulnerable in the latest commit. Ensure all nodes are patched. Only then will we safely return the funds after confirming the fix,” followed by an encrypted message sent to Blockstream’s PGP key.
In the same block, a clear‑signed reply from Blockstream confirmed “Yes, thank you.” A few hours later, Blockstream issued another clear‑text statement: “Bridge nodes are patched; it is safe to return the funds.”
Minutes after the 3,400 BTC arrived, the white‑hats returned 85% of the amount, retaining 15% as an implied finder’s fee. Some praised the decision on X as preferable to retaining 100%, while others expressed surprise at the size. Although 15% may seem modest, the total value approaches $50 million at current prices. Blockstream expressed displeasure, sending four encrypted messages a few hours later—presumably after internal discussions and legal review. An additional encrypted message followed an hour later.
The white‑hats responded with two encrypted messages; Blockstream replied an hour later. The white‑hats then posted a solitary “” sad‑face emoji, indicating that negotiations over reducing the bounty’s size were unsuccessful. Blockstream’s technical team appears displeased with the size of the finder’s fee. The contents of the encrypted messages remain undisclosed, and Blockstream has not issued any public comment. The situation appears ongoing.
The full conversation is publicly accessible on a vibe‑coded platform (by the author). Additional researchers, including Sjors (GitHub gist) and Alex Thorn of Galaxy Research, are monitoring the discussion and on‑chain data.
Liquid’s Sunday statement remains the network’s latest official update: the alleged white‑hats withdrew roughly 4,000 BTC via the SideSwap peg‑out route, while the PAK itself remained intact, other issued assets were unaffected, and the sidechain was paused. As of this writing, Liquid and Blockstream have not released a new statement regarding the 3,400 BTC return. SideSwap noted that the L‑BTC in the original peg‑out originated from an Elements bug.
