Liquid Hackers Return 3,400 BTC, Keep $47 Million After On-Chain Deal With Blockstream
Whitehat hackers drained $320M from Blockstream's Liquid Network, then returned 85% of it once the underlying bug was patched.
Self-described white-hat attackers who drained nearly 4,000 bitcoin from Blockstream's Liquid Network have sent most of it back. After a public negotiation on Bitcoin itself, they returned 3,400 BTC to the federation wallet and kept about 598 BTC, roughly $47 million, as an apparent bounty.
The incident began Sunday, September 6. About $320 million left the wallet that is supposed to back Liquid's pegged token, L-BTC, one-for-one, and reserves fell from around 4,200 BTC to roughly 200, leaving circulating L-BTC far from fully collateralized.
This was not a stolen-key heist. Liquid and SideSwap both said no federation keys were compromised. A bug in Elements, the open-source software Liquid runs on, let the attackers mint unbacked L-BTC, which was then sent through SideSwap's peg-out service and processed like any other order. Eleven of the federation's fifteen signers approved a withdrawal that looked valid under the network's rules. Other assets on Liquid were untouched, and Bitcoin's main chain was unaffected.
The attackers did not vanish. They wrote into a Bitcoin transaction: "we are whitehats. contact us on chain." Blockstream answered the same way, embedding PGP-signed messages in OP_RETURN data. The group made the return conditional on Blockstream patching the bug and updating every node, because the chain was still at risk. Only then would they send the coins back.
Blockstream later posted a signed note that bridge nodes were patched and it was "safe to return the funds." The 3,400 BTC followed, about 85% of what was taken. Samson Mow, the former Blockstream executive who has been posting updates, said talks over the remaining 598 BTC were continuing.
Liquid is still paused. Bridge nodes are down, exchanges have frozen L-BTC deposits and withdrawals, and operators say they need more fixes and a clean restart before peg services resume. Holders have been told not to send bitcoin to peg-in addresses until that restart is confirmed.
The return pulled the network back from an immediate reserve collapse. The harder part remains: full backing has to be restored if those last coins stay gone, and it's still unclear whether this was responsible disclosure or a $47 million self-assigned fee.
