Liquid Hackers Return $270M in Bitcoin After Swiping $320 Million

The self-proclaimed "white hat hackers" behind the withdrawal of roughly 4,000 BTC from Liquid Network returned 3,400 BTC, worth around $269.2 million, to the sidechain's federation wallet Monday, recovering about 85% of the funds.

Despite the return, approximately 598.5 BTC, worth about $47 million, remains in the address linked to the withdrawal.

The incident began Sunday when a customer sent 4,000 L-BTC to SideSwap's peg-out service. The actors later called themselves "whitehats"—ethical hackers who identify security flaws to help organizations fix them—in a Bitcoin transaction message.

Ledger Chief Technology Officer Charles Guillemet remained skeptical of the actors' white-hat claim after most of the funds were returned.

"So, 3,400 BTC were refunded," Guillemet wrote on X. "The 'white hats' still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!"

Liquid disabled its bridge nodes after the withdrawal and asked exchanges to suspend L-BTC deposits and withdrawals.

The return leaves Liquid with nearly 600 BTC still outstanding. The network has not said whether those coins will be returned, how it will cover any remaining gap in L-BTC backing, or when the sidechain and its peg services will resume normal operations.

The return followed a series of messages exchanged with Blockstream, the developers of the Liquid sidechain, and the hackers through Bitcoin transactions.

"Please fix the bug first," the actors wrote. "The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix."

Blockstream later sent a signed message stating, "Bridge nodes are patched, safe to return the funds."

The actors then transferred 3,400 BTC to the Liquid Federation address. They had previously offered to return "most" of the Bitcoin but have not publicly explained why they kept the remainder.

Blockstream did not immediately respond to a request for comment by Decrypt.