Allegedly, "white hat" hackers have returned 3,400 Bitcoin, worth approximately $270 million, to the Liquid federation wallet after withdrawing around $320 million from the reserves of the Bitcoin sidechain.
On Monday, Samson Mow, CEO of JAN3 and former Blockstream executive, stated that the fund return followed Blockstream's confirmation of updated affected bridge nodes. According to him, about 598 $BTC remain unrecovered, and Blockstream continues to engage with the threat actors.
The fund return follows a security incident on Sunday during which hackers withdrew around 4,000 $BTC from a wallet containing approximately 4,200 $BTC. On-chain ledger data shows that exactly 3,400 $BTC were transferred back to the federation wallet address.
Blockstream reported that the updated software has been deployed, and federation members were preparing for a coordinated restart. Liquid issues L-$BTC backed by Bitcoin held by the federation, so the return of about 85% of the withdrawn Bitcoin restores a significant portion of the collateral lost in the incident, as the suspended network prepares to resume operations.
Bitcoin Return Followed On-Chain Negotiations
The initial withdrawal was conducted via SideSwap company's Peg-out authorization key, although both Liquid and SideSwap stated the key itself was not compromised. SideSwap reported that the L-$BTC involved originated from a bug in Elements — the open-source software underlying Liquid.
Blockstream contacted the threat actors via signed messages embedded in Bitcoin transactions. The threat actors, calling themselves "white hats," stated they would return most of the funds after the vulnerability was patched and the fix installed on each node.
Read also: Bitcoin From Satoshi Era Awakens After 16 Years of Inactivity: 600 $BTC Moved
Mow stated that Liquid remained suspended as Blockstream and federation members deployed additional fixes and security enhancements, resolved a chain split, and prepared for a safe restart. He urged users not to send Bitcoin to Liquid peg-in addresses until network restart is confirmed, adding that no other action is required from users.
Ledger CTO Charles Guillemet questioned the threat actors' claim of being "white hats" following the partial return. He said if the approximately 600 $BTC remaining under their control constituted a reward agreed upon through encrypted on-chain communications, this arrangement "looks more like extortion than a 'white hat' hack."
Neither Blockstream nor Liquid has publicly called the unrecovered Bitcoin a reward or disclosed the terms of the return. Cointelegraph contacted both companies for comment but did not receive a response by the time of publication.
Magazine: "White Hats" Took 4,000 $BTC From Liquid, ETFs See Best 2026 Inflows: Hodler's Digest
end-content
