The Liquid Network recovered 3,400 BTC on September 7 after a group described as white hats returned funds withdrawn from the federation wallet. The group retained 598.5 BTC, approximately 15% of the total, at an implied value of around $48 million.
The return transaction was confirmed at 16:09 UTC and sent the funds back to the labeled Liquid peg script address while directing the retained amount to the white hat holder address as change.
On-Chain Communications
The transfer followed a series of messages exchanged through Bitcoin's blockchain. The white hats initiated contact by publishing a message in the OP_RETURN data field requesting communication. A Blockstream-linked address responded with contact instructions, followed by encrypted payloads and PGP signatures verifiable against Blockstream's published security key.
In block 965869, the white hats asked whether returning "most" of the funds to the federation script would be acceptable. They subsequently requested that Blockstream fix an identified bug and ensure all nodes were patched before funds were transferred back.
Blockstream confirmed that bridge nodes had been patched and that it was safe to return the funds. The 3,400 BTC transfer occurred shortly after this confirmation.
Disputed Bounty Amount
The retention of 598.5 BTC triggered further encrypted communications between the parties. Multiple encrypted messages were exchanged between Blockstream and the white hats in the hours following the return, with the parties appearing unable to reach agreement on the finder's fee amount. The white hats subsequently posted a sad face emoji on chain, suggesting negotiations did not proceed favorably.
Blockstream has not issued a public statement regarding the retained amount or the contents of encrypted exchanges.
Background
The white hats had withdrawn approximately 4,000 BTC through the SideSwap peg-out path on Sunday. SideSwap attributed the withdrawal to an Elements bug. Liquid's announcement confirmed that the PAK was not compromised, other issued assets remained unaffected, and the sidechain was paused. As of the original reporting, Liquid and Blockstream had not published updated statements on the 3,400 BTC return.
