Purported white-hat hackers have returned 3,400 Bitcoin worth approximately $270 million to the Liquid Federation wallet after withdrawing roughly $320 million from the Bitcoin sidechain's reserves in a Sunday security incident.
According to JAN3 CEO Samson Mow, the return followed confirmation from Blockstream that affected bridge nodes had been patched. Approximately 598 BTC remains outstanding, with Blockstream continuing to engage with the actors. The incident involved hackers withdrawing about 4,000 BTC from the wallet's roughly 4,200 BTC reserves, with onchain records showing that exactly 3,400 BTC was transferred back to the federation's wallet address.
Network Preparations
Blockstream said updated software had been deployed and federation members were preparing for a coordinated restart. Since Liquid issues L-BTC against Bitcoin held by its federation, the return of approximately 85% of the withdrawn Bitcoin restores much of the backing removed in the incident.
Mow advised users not to send Bitcoin to Liquid peg-in addresses until the network's restart is confirmed, adding that no other user action was required at that time.
Details of the Incident
The original withdrawal was processed through SideSwap's Peg-out Authorization Key, though both Liquid and SideSwap stated the key itself was not compromised. SideSwap attributed the L-BTC involved to a bug in Elements, the open-source software underpinning Liquid.
Blockstream contacted the actors through signed messages embedded in Bitcoin transactions. The actors identified themselves as white hats and said they would return most funds once the vulnerability was fixed and every node had installed the patch.
Disputed Classification
Ledger chief technology officer Charles Guillemet questioned the actors' white-hat description following the partial return. He suggested that if the roughly 600 BTC still under their control represented a negotiated reward through encrypted onchain communications, the arrangement appeared more like extortion than white-hat hacking.
Neither Blockstream nor Liquid publicly described the outstanding Bitcoin as a bounty or disclosed any repayment terms.
