Liquid ‘white hats’ return $270M in Bitcoin as network prepares restart

Purported white-hat hackers returned 3,400 Bitcoin worth about $270 million to the Liquid Federation wallet after withdrawing roughly $320 million from the Bitcoin sidechain’s reserves. 

On Monday, JAN3 CEO and former Blockstream executive Samson Mow said the return followed confirmation from Blockstream that the affected bridge nodes had been patched. He said about 598 BTC remains outstanding and that Blockstream continues to engage with the actors.

The return follows a Sunday security incident in which hackers withdrew about 4,000 BTC from the wallet’s roughly 4,200 BTC. Onchain records show that exactly 3,400 BTC was transferred back to the federation’s wallet address. 

Blockstream said updated software had been deployed and federation members were preparing for a coordinated restart. Liquid issues L-BTC against Bitcoin held by its federation, so the return of about 85% of the withdrawn Bitcoin restores much of the backing removed in the incident as the paused network prepares to resume operations. 

Bitcoin return follows onchain negotiations

The original withdrawal was processed through SideSwap’s Peg-out Authorization Key, although Liquid and SideSwap said the key itself was not compromised. SideSwap said the L-BTC involved originated from a bug in Elements, the open-source software underpinning Liquid.