A whitehat hacker is holding $320 million in drained Bitcoin until developers prove they patched a fatal network flaw

Liquid Network was effectively halted after nearly $320 million in Bitcoin left its federation reserve through an abnormal peg-out.

The incident began Sept. 6 when a customer submitted 4,000 L-BTC to SideSwap’s peg-out service, which converts Bitcoin represented on Liquid back into BTC on the main network.

SideSwap said the request passed the normal authorization process and prompted the Liquid Federation to release about 3,996 BTC. The Bitcoin later moved to an address that held roughly 3,998.5 BTC at the latest check.

Liquid disabled its bridge nodes after the withdrawal, while SideSwap suspended swaps, peg-ins, and peg-outs. Exchanges also paused or prepared to pause L-BTC deposits and withdrawals as operators investigated the incident.

The actors controlling the Bitcoin subsequently identified themselves through on-chain messages as “whitehats” and said they intended to return most of the funds once the underlying bug had been fixed across the network.

That prospect could limit the eventual financial loss. However, it does not resolve the more important question of how almost 4,000 BTC left the federation without an apparent key compromise.

The withdrawal appears to have followed the rules