White‑hat actors transferred 3,400 Bitcoin, valued at roughly $270 million, back to the Liquid Federation wallet after having withdrawn about 4,000 BTC from the sidechain’s reserves. The return represents roughly 85% of the stolen funds and restores most of the backing for Liquid’s L‑BTC tokens, which are issued against Bitcoin held by the federation.
Liquid’s network remains paused while Blockstream and the federation implement further security fixes, resolve a chain split, and prepare for a coordinated restart. Blockstream confirmed that the bridge nodes involved in the incident have been patched and that updated software has been deployed across the network.
The original withdrawal was executed through SideSwap’s Peg‑out Authorization Key, though both Liquid and SideSwap said the key itself was not compromised. SideSwap attributed the loss to a bug in Elements, the open‑source software that underpins Liquid. Blockstream contacted the actors via signed messages embedded in Bitcoin transactions; the actors identified themselves as white‑hats and agreed to return most of the funds once the vulnerability was fixed and all nodes were updated.
JAN3 CEO Samson Mow, a former Blockstream executive, said about 598 BTC remains outstanding and that Blockstream continues to engage with the actors. He advised users not to send Bitcoin to Liquid peg‑in addresses until the network’s restart is confirmed, noting that no further user action is required.
Ledger’s chief technology officer Charles Guillemet questioned the white‑hat label, suggesting that the pending 598 BTC could resemble an extortion payment rather than a benevolent return. Neither Blockstream nor Liquid disclosed any bounty terms for the remaining Bitcoin.
Cointelegraph did not receive comment from the companies before publication.
