Purported White-Hat Hackers Return $270 Million in Bitcoin to Liquid Federation After Security Incident

In a dramatic turn of events following a significant security incident, purported white-hat hackers have returned approximately 3,400 Bitcoin (BTC), valued at around $270 million, to the Liquid Federation’s wallet. This comes after the same actors had previously withdrawn roughly $320 million from the Bitcoin sidechain’s reserves.

The return of the majority of the withdrawn funds was confirmed on Monday by Samson Mow, CEO of JAN3 and a former executive at Blockstream, a key entity behind the Liquid Network. Mow stated that the decision to return the Bitcoin followed confirmation from Blockstream that the affected bridge nodes had been successfully patched. He further indicated that approximately 598 BTC remains outstanding, and Blockstream continues to engage with the individuals responsible for the withdrawal.

This repatriation of funds follows a security incident that unfolded on Sunday. During this event, hackers managed to withdraw approximately 4,000 BTC from the Liquid Network’s reserves, which held around 4,200 BTC at the time. On-chain transaction records corroborate the return, showing that precisely 3,400 BTC was transferred back to the federation’s designated wallet address.

Blockstream announced that updated software has been deployed across the network, and federation members are in the process of preparing for a coordinated restart of the Liquid Network. The Liquid Network operates by issuing L-BTC, a synthetic Bitcoin asset, against actual Bitcoin held in reserve by its federation. Therefore, the return of roughly 85% of the withdrawn Bitcoin significantly restores the backing that was removed during the incident, as the network gears up to resume normal operations.

Bitcoin Return Follows Onchain Negotiations and Vulnerability Fixes

The initial withdrawal of funds was facilitated through SideSwap’s Peg-out Authorization Key. However, both Liquid and SideSwap representatives emphasized that the key itself was not compromised during the incident. Instead, SideSwap indicated that the L-BTC involved in the withdrawal originated from a bug within Elements, the open-source software framework that underpins the Liquid Network.

Following the discovery of the exploit, Blockstream initiated communication with the actors responsible for the withdrawal. This communication was conducted through signed messages embedded within Bitcoin transactions. The individuals, who identified themselves as white-hat hackers, reportedly agreed to return a substantial portion of the funds once the underlying vulnerability was addressed and all nodes on the network had successfully installed the necessary patch.

The situation has also sparked debate within the cryptocurrency community regarding the nature of the actors’ actions. Charles Guillemet, Chief Technology Officer at Ledger, publicly questioned the "white-hat" designation following the partial return of funds. Guillemet suggested that if the remaining approximately 600 BTC under the actors’ control represented a negotiated reward for their actions, secured through encrypted on-chain communications, the arrangement bore a closer resemblance to "extortion than white-hat hacking."

Neither Blockstream nor Liquid has publicly characterized the outstanding Bitcoin as a bounty or disclosed any specific repayment terms for the remaining amount. Cointelegraph reached out to both companies for comment prior to publication but did not receive a response.

Samson Mow also provided further details regarding the ongoing recovery and restart process. He stated that the Liquid Network remains paused while Blockstream and federation members implement additional fixes, enhance security measures, resolve a temporary chain split that occurred as a result of the incident, and meticulously prepare for a secure restart. Users have been advised by Mow not to send Bitcoin to Liquid peg-in addresses until the network’s restart is officially confirmed. For existing users, no further action is required at this time.

The incident highlights the complex interplay between security, decentralized networks, and the ethical considerations surrounding vulnerability disclosure and remediation within the cryptocurrency space. The return of the majority of the stolen funds, coupled with ongoing negotiations, suggests a resolution is in progress, though questions about the actors’ motivations and the ultimate fate of the remaining Bitcoin persist.