The self-proclaimed “white hat hackers” behind a major security breach on the Liquid Network have returned approximately 3,400 Bitcoin (BTC), valued at around $269.2 million, to the platform’s federation wallet. The recovery represents about 85% of the total 4,000 BTC—worth roughly $320 million at the time—siphoned during the exploit.
Despite the partial return, approximately 598.5 BTC, valued at nearly $47 million, remains in the address linked to the withdrawal. The hackers have not publicly disclosed why they retained the remaining funds.
The incident began Sunday when a customer sent 4,000 L-BTC to SideSwap’s peg-out service. The actors later called themselves “whitehats”—ethical hackers who identify security flaws to help organizations fix them—in a Bitcoin transaction message.
The return of the funds followed a series of messages exchanged with Blockstream, the developers of the Liquid sidechain, and the hackers through Bitcoin transactions. The actors wrote, “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
Blockstream later sent a signed message stating, “Bridge nodes are patched, safe to return the funds.” The actors then transferred 3,400 BTC to the Liquid Federation address. They had previously offered to return “most” of the Bitcoin but have not publicly explained why they kept the remainder.
Ledger Chief Technology Officer Charles Guillemet remained skeptical of the actors’ white-hat claim after most of the funds were returned. Writing on X, Guillemet stated, “So, 3,400 BTC were refunded. The ‘white hats’ still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!”
Liquid disabled its bridge nodes after the withdrawal and asked exchanges to suspend L-BTC deposits and withdrawals. The return leaves Liquid with nearly 600 BTC still outstanding. The network has not said whether those coins will be returned, how it will cover any remaining gap in L-BTC backing, or when the sidechain and its peg services will resume normal operations. Blockstream did not immediately respond to a request for comment by Decrypt.
