Liquid Hackers Return $270M in Bitcoin After Swiping $320 Million

In brief

• The actors behind Liquid’s 4,000 BTC security incident returned 3,400 BTC to the federation wallet.
• The transfer followed a signed message from Blockstream saying Liquid’s bridge nodes had been patched.
• Nearly 600 BTC remains outstanding, and Liquid has not announced when normal operations will resume.

The self-proclaimed “white hat hackers” behind the withdrawal of roughly 4,000 BTC from Liquid Network returned 3,400 BTC, worth around $269.2 million, to the sidechain’s federation wallet Monday, recovering about 85% of the funds.

Despite the return, approximately 598.5 BTC, worth about $47 million, remains in the address linked to the withdrawal.

The incident began Sunday when a customer sent 4,000 L-BTC to SideSwap’s peg-out service. The actors later called themselves “whitehats”—ethical hackers who identify security flaws to help organizations fix them—in a Bitcoin transaction message.

Ledger Chief Technology Officer Charles Guillemet remained skeptical of the actors’ white-hat claim after most of the funds were returned.

“So, 3,400 BTC were refunded,” Guillemet wrote on X. “The ‘white hats’ still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!”