The actors behind a security incident at Liquid Network returned 3,400 BTC, valued around $269.2 million, to the sidechain's federation wallet on Monday, recovering roughly 85% of the withdrawn funds. Approximately 598.5 BTC, worth about $47 million, remains in an address linked to the incident.
The withdrawal began Sunday when a customer sent 4,000 L-BTC to SideSwap's peg-out service. The actors later identified themselves as "white hat hackers"—ethical hackers who identify security flaws—in messages embedded in Bitcoin transactions.
After the withdrawal, Liquid disabled its bridge nodes and requested exchanges suspend L-BTC deposits and withdrawals. Communication between Blockstream, Liquid's developer, and the hackers occurred through Bitcoin transaction messages.
The actors emphasized the urgency of patching the vulnerability, writing: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix."
Blockstream responded with a signed message stating: "Bridge nodes are patched, safe to return the funds." The actors then transferred 3,400 BTC to the Liquid Federation address but have not publicly explained why they retained the remainder.
Ledger Chief Technology Officer Charles Guillemet expressed skepticism of the white-hat characterization, suggesting the retained funds amounted to extortion rather than a negotiated security reward.
Liquid has not announced when the sidechain and its peg services will resume normal operations, nor has it clarified how it will address the remaining outstanding BTC or cover any gap in L-BTC backing.
