Liquid ‘White Hats’ Return $270M in Bitcoin Ahead of Restart

Purported white-hat hackers returned 3,400 Bitcoin, worth approximately $270 million, to the Liquid Federation wallet after withdrawing about 4,000 BTC, or roughly $320 million, from the Bitcoin sidechain’s reserves. Onchain records show the returned amount represents approximately 85% of the funds taken during Sunday’s security incident. Liquid issues L-BTC against Bitcoin held by its federation, so the return restores most of the backing removed as the network prepares to resume operations.

JAN3 CEO and former Blockstream executive Samson Mow said the return followed confirmation from Blockstream that the affected bridge nodes had been patched. Blockstream said updated software had been deployed and federation members were preparing for a coordinated restart while teams continued additional fixes, security improvements and resolution of a chain split. Liquid and SideSwap said the withdrawal was processed through SideSwap’s Peg-out Authorization Key, but the key itself was not compromised. SideSwap attributed the L-BTC involved to a bug in Elements, the open-source software underpinning Liquid. Users were advised not to send Bitcoin to Liquid peg-in addresses until the restart is confirmed, with no other action required.

The actors, who identified themselves as white hats, reportedly said they would return most of the funds after the vulnerability was fixed and every node had installed the patch. About 598 BTC remains outstanding, and Blockstream continues to engage with the actors. Ledger chief technology officer Charles Guillemet questioned the white-hat description, saying that if the remaining Bitcoin represented a reward negotiated through encrypted onchain communications, the arrangement could look more like extortion than white-hat hacking. Neither Blockstream nor Liquid described the outstanding Bitcoin as a bounty or disclosed repayment terms.