TLDR
White hat hackers say they will return the 4,000 Bitcoin (BTC) they drained from the Liquid Network, but the reality is more complicated.
- Self described white hats exploited Blockstreams Liquid sidechain and withdrew about 4,000 BTC, worth roughly 320 million dollars, then offered to return the funds once a bug was fixed.
- After Blockstream patched the vulnerability, the attackers sent back around 3,400 BTC to the federation wallet, keeping about 598.5 BTC, so only about 85 percent of the funds have actually been recovered.
- The episode highlights ongoing bridge and sidechain risks, puts Liquids 1 to 1 BTC peg under scrutiny, and leaves open questions about the remaining BTC and whether this was ethical hacking or extortion.
Deep Dive
1. How 4,000 BTC Was Taken
Liquid Network is a Bitcoin sidechain operated by Blockstream, where users lock BTC on mainnet and receive Liquid BTC (L BTC) on the sidechain. A bug in the Elements software used by Liquid allowed attackers to create unbacked L BTC and peg them out for real BTC from the reserve.
Nearly 4,000 BTC, about 95 percent of Liquids reported reserves, were withdrawn from the federation wallet in one incident, prompting Liquid to pause bridge nodes and ask exchanges to halt L BTC deposits and withdrawals. The actors left on chain messages claiming we are whitehats and opened negotiations with Blockstream over Bitcoin OP RETURN transactions. Reports from outlets like CryptoPotato and Bitcoin.com detail the exploit and on chain dialogue between the parties.
2. What Has Been Returned So Far
Following Blockstreams announcement that bridge nodes were patched, the attackers sent back 3,400 BTC to the federation wallet, recovering roughly 85 percent of the stolen funds. Around 598.5 BTC, worth about 47 million dollars, remains in the address linked to the withdrawal, according to coverage from Decrypt and Bitcoin.com.
Liquid remains effectively frozen while operators work to restore full 1 to 1 backing for L BTC and decide how to handle the missing BTC. Some security experts, including Ledgers CTO, have questioned whether keeping hundreds of BTC is compatible with white hat behavior, arguing that the line between a negotiated bounty and coercion is blurry in this case.
3. Why This Matters For Crypto Users
This incident shows that even federated, non permissionless bridges can suffer catastrophic failures if their issuance and redemption logic has bugs. Users who relied on L BTC as fully backed now face uncertainty about reserves and timing for redemptions and transfers.
More broadly, it reinforces that any wrapped asset or sidechain peg depends not just on cryptography, but also on correct implementation and governance around upgrades and incident response.
If you use sidechains or bridges, it is critical to understand how reserves are held, how incidents are handled, and whether you are comfortable with the trust and failure modes those systems imply.
Conclusion
White hats have agreed, in principle, to return the 4,000 BTC they took from Liquid, but only about 3,400 BTC is back so far, with hundreds of BTC still missing. The episode underscores that bridge and sidechain design can be a single point of failure and that ethical hacking claims are contested when large sums remain with the exploiters. What matters next is whether Liquid can fully restore its peg, how the remaining BTC is resolved, and what technical and governance changes follow to reduce similar risks across the Bitcoin ecosystem.
CoinsKid.Com