Liquid “white hats” return $270M in BTC as network readies restart

“White-hat” actors have returned 3,400 Bitcoin—worth roughly $270 million—to the Liquid Federation wallet after an earlier attack that pulled funds from the Bitcoin side of Liquid’s reserves. The repayment followed a claim from bridge operator Blockstream that the impacted federation bridge nodes had been patched.

According to JAN3 CEO and former Blockstream executive Samson Mow, about 598 BTC remains outstanding. He added that Blockstream is still engaging with the actors while Liquid prepares to resume operations.

Key takeaways

• 3,400 BTC has been transferred back on-chain to the Liquid Federation wallet address, restoring much of the backing after the earlier withdrawal.
• Blockstream says updated software was deployed and federation members are preparing a coordinated restart after patching affected bridge nodes.
• On-chain transfers confirm the return amount, while 598 BTC remains unaccounted for.
• Liquid was paused after the incident, and users were advised not to send Bitcoin to Liquid peg-in addresses until restart confirmation.
• The incident appears tied to a bug in Elements, though SideSwap and Liquid say the specific authorization key was not compromised.

Return of most withdrawn Bitcoin after Liquid patching

The sequence began with a Sunday security incident in which hackers withdrew about 4,000 BTC from the Liquid Federation wallet’s Bitcoin-side reserves. The wallet reportedly held around 4,200 BTC before the withdrawal, leaving the system with a reduced buffer for issuing or supporting Liquid’s pegged asset, L-BTC.

On Monday, Mow reported that the return of 3,400 BTC came after Blockstream confirmed bridge nodes had been patched. He also said Liquid remained paused during additional fixes and security improvements, including work to resolve a chain split and prepare for a safe restart.

Blockchain explorer records cited in the article show that the federation wallet received exactly 3,400 BTC back via a transfer to the federation’s wallet address. With the return of roughly 85% of the withdrawn amount, the incident’s immediate impact on the system’s backing was largely reduced, at least temporarily, as the network prepares to restart.

Why users were told to wait on peg-ins

Liquid operates by issuing L-BTC against Bitcoin held by the federation. When the federation’s reserves on the Bitcoin side are disrupted, the corresponding backing for issued L-BTC can be impaired—one reason the network was paused and why the community received operational instructions.

Mow said users should avoid sending Bitcoin to Liquid peg-in addresses until a restart is confirmed. He emphasized that no user action was otherwise required, framing the pause as a protective step while the federation coordinates the patched state of the network.

For market participants and users who rely on Liquid for faster settlement or routing, this kind of instruction matters operationally: sending BTC to a paused peg-in path can create delays or confusion if balances are not processed until the network is fully back online.

SideSwap, Elements, and the authorization key that was not “compromised”

Details around how the incident was carried out point to the mechanics of Liquid’s peg-out process. The withdrawal was processed through SideSwap’s Peg-out Authorization Key, though Liquid and SideSwap stated that the key itself was not compromised.

Instead, SideSwap attributed the L-BTC involved to a bug in Elements, the open-source software underlying Liquid. That distinction—between a compromised key versus a flaw in the software logic that enabled the malicious outcome—has implications for remediation.

If the authorization infrastructure remained intact but a bug allowed the system to produce unintended results, then the focus for recovery becomes twofold: deploying patched software across all relevant nodes and ensuring any chain state issues are corrected through a coordinated restart.

On-chain negotiations—and lingering questions over the “white-hat” label

Blockstream said it contacted the actors using signed messages embedded in Bitcoin transactions. The actors described themselves as white hats and said they would return most funds once the vulnerability was fixed and every node installed the patch.

However, the partial nature of the return has also raised skepticism from industry observers. Ledger chief technology officer Charles Guillemet questioned the “white-hat” characterization after the transfer of 3,400 BTC. He argued that if the remaining roughly 600 BTC represented a negotiated reward communicated via encrypted on-chain communications, the arrangement could resemble extortion rather than benign security research.

Neither Blockstream nor Liquid publicly described the outstanding Bitcoin as a bounty, nor did they disclose any repayment terms. The article also notes that Cointelegraph sought comment from both organizations but did not receive a response before publication.

This uncertainty is likely to remain a key point for readers watching the situation. Even if a vulnerability was identified and patched, the open question is what—if anything—motivated the withheld balance and whether the return was strictly conditional on remediation or involved separate demands. Without official terms, participants must rely on what is visible on-chain and what the organizations involved choose to clarify later.

What to monitor as Liquid prepares its restart

With Liquid paused, the most immediate thing to watch is whether Blockstream and federation members execute a coordinated restart cleanly after patching and resolving the chain split referenced by Mow. Just as importantly, attention should stay on whether the remaining ~598 BTC is returned and what—if any—additional guidance is issued to users regarding peg-in and peg-out operations.