Liquid Network Hackers Return $269M Bitcoin, Retain $47M
In brief
- Hackers returned 3,400 BTC worth $269.2 million to Liquid's federation wallet Monday
- Approximately 598.5 BTC worth $47 million remains unaccounted for in withdrawal address
- Blockstream confirmed bridge nodes patched via signed on-chain message
- Ledger CTO Charles Guillemet characterized situation as extortion, not white-hat hacking
- Liquid disabled bridge nodes and requested exchanges suspend L-BTC trading
The Incident and Response
The incident began Sunday when a customer sent 4,000 L-BTC to SideSwap's peg-out service. Once the coins left Liquid's bridge, the actors gained control. Liquid disabled its bridge nodes after the withdrawal and asked exchanges to suspend L-BTC deposits and withdrawals.
What followed was unusual: a direct negotiation through Bitcoin transaction messages between the hackers and Blockstream's developers. The actors identified themselves as white-hat hackers in a Bitcoin transaction message, claiming they'd discovered a critical vulnerability. The hackers requested that Blockstream fix the bug and patch all nodes before returning funds.
Blockstream Confirms Patch, Funds Flow Back
Blockstream sent a signed message stating that bridge nodes are patched and safe to return funds. That confirmation appears to have triggered the partial return. The hackers returned 3,400 BTC, worth around $269.2 million, to the sidechain's federation wallet Monday.
But skepticism lingers. Ledger Chief Technology Officer Charles Guillemet expressed skepticism about the white-hat claim, saying the situation looks more like extortion than ethical disclosure. The fact that approximately 598.5 BTC, worth about $47 million, remains in the address linked to the withdrawal only deepens that suspicion.
The Unanswered Questions
The hackers have not publicly explained why they retained approximately 600 BTC. Liquid has not stated whether the remaining coins will be returned or how it will cover any gap in L-BTC backing.
The silence on both sides leaves the Liquid network in limbo. The bridge is operational again, but trust in its security model has taken a hit. Whether the remaining Bitcoin is a negotiating tactic, a reward for the disclosure, or something else entirely remains unclear.
Frequently asked questions
Why did the hackers return the Bitcoin?
Blockstream sent a signed message confirming that Liquid's bridge nodes had been patched and were safe. The hackers had demanded the fix before returning funds, citing security risks. Once Blockstream confirmed the patch, they returned 3,400 BTC to the federation wallet.
What happened to the remaining 600 BTC?
Approximately 598.5 BTC worth about $47 million remains in the withdrawal address. The hackers have not publicly explained why they kept it, and Liquid has not disclosed whether the coins will be returned or how the network will address any gap in L-BTC backing.
Are these really white-hat hackers?
The actors called themselves white-hats and claimed to have discovered a security vulnerability. However, Ledger CTO Charles Guillemet expressed skepticism, stating the situation looks more like extortion than ethical hacking, especially given the partial return and retained funds.
