After on-chain talks, Liquid recovers 3,400 BTC; white hats keep 598.5 BTC

The group describing themselves as "white hats" took nearly 4,000 BTC from the Liquid Network federation wallet on Sunday, then returned 3,400 BTC on Monday. The remaining approximately 598 BTC (around 15% of the total) stayed at the same address, acting as an implied bounty worth $48 million.

The return transaction (bc49a46d) was confirmed at 16:09 UTC on September 7. It sent exactly 3,400 BTC to the Liquid peg script address and passed the 598.5 BTC change back to the white hat hacker address.

Before the transfer, messages were inscribed in Bitcoin blocks over a day. The white hats first posted an on-chain transaction with the OP_RETURN message "contact us on chain", originating from the address that held the 4,000 BTC taken from Liquid Network.

A Blockstream-linked address replied with "Please contact security@blockstream.com". Later notes from that sender contained Electrum-encrypted payloads and PGP signatures verifiable against Blockstream's published security key.

In block 865869, the white hats asked in clear text whether sending "most" back to the federation script was acceptable. The 1,000-sat output on that transaction was only a message carrier.

Soon after, the white hats wrote: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix." That was followed by an encrypted snippet addressed to Blockstream's PGP key.

In the same block, a clear-signed reply from the Blockstream sender stated "Yes, thank you." Hours later, the same account posted another plain-text message: "Bridge nodes are patched, safe to return the funds".

Minutes after the 3,400 BTC arrived, the white hats returned 85% of the funds and kept 15% as an implied finder's fee. The choice drew reactions on X: some praised it as 'better than keeping 100%', while others were shocked at the amount. Although 15% may seem reasonable, the absolute sum is so large that it nears $50 million at current prices. Blockstream was clearly unhappy about the bounty, as four encrypted messages followed on-chain a few hours later, likely after the immediate crisis was managed and legal counsel had consulted. An hour later, Blockstream posted another encrypted message.

The white hats answered with two encrypted messages. Blockstream replied once an hour later. Then the white hats posted a simple but significant sad face emoji. That emoji conveys a lot; it suggests negotiations over reducing the bounty amount did not go well. Blockstream's team appears greatly upset about the size of the finder's fee. What was said in those encrypted messages is unknown, and Blockstream has made no public statements. One can assume the matter is not concluded.

A site built by the author hosts the complete conversation. Several other researchers track the discussion and on-chain data, including Sjors's GitHub gist and Alex Thorn from Galaxy Research.

Liquid's Sunday statement remains the network's last official post: purported white hats withdrew about 4,000 BTC through the SideSwap peg-out path, the PAK itself was not compromised, other issued assets were unaffected, and the sidechain was paused. Neither Liquid nor Blockstream had posted a new statement on the 3,400 BTC return as of writing. SideSwap had stated the L-BTC in the original peg-out "came from an Elements bug."