Liquid Network has recovered 3,400 BTC from the group behind a disputed 4,000 BTC withdrawal, according to on-chain data reviewed after the transfer. The returned amount was worth about $268.2 million at confirmation and represented roughly 85% of the Bitcoin taken from the network’s federation wallet.
About 598.5 BTC, valued at roughly $47 million, remained in the withdrawal-linked address after the repayment. The actors have described themselves as white-hat hackers, but no public agreement has been disclosed that would authorize the withdrawal, define a bounty, or explain why nearly 600 BTC is still being held.
Repayment followed on-chain exchange
The 3,400 BTC was sent back to the Liquid Federation wallet in Bitcoin block 965,950. Before the repayment, Blockstream had communicated with the actors through signed messages attached to Bitcoin transactions, saying its bridge nodes had been patched and that the funds were safe to return.
The same on-chain channel had been used earlier by the actors, who told Blockstream to fix the flaw before any repayment. In one message, they said the chain was at risk at the latest commit and instructed the company to ensure every node was patched before they would send the money back. Neither side has released a technical report detailing the bug or how the withdrawal was carried out.
Incident began with SideSwap peg-out
The episode started on Sunday when a customer sent 4,000 Liquid Bitcoin, or L-BTC, to SideSwap’s peg-out service. SideSwap is used to move value from the Liquid sidechain back to the Bitcoin network through an authorized withdrawal process.
Before any funds were returned, the 4,000 BTC withdrawal accounted for about 95% of the Bitcoin reportedly held in Liquid’s federation wallet. The actors later said they would return most of the coins once Blockstream fixed the vulnerability, a promise that has now only been partly fulfilled based on current on-chain balances.
White-hat claim faces scrutiny
The group identified itself as white hats in a message attached to a Bitcoin transaction. In crypto security, that label usually refers to researchers who expose weaknesses so they can be fixed, often under bounty terms agreed in advance with the affected project.
That description has been challenged because no such terms have been made public here. Ledger Chief Technology Officer Charles Guillemet wrote on X that keeping around 600 BTC without a disclosed on-chain agreement looked more like extortion than white-hat hacking. His criticism centered on the absence of published conditions covering any reward or retained funds.
The article also noted that calling an action white-hat does not settle any legal question by itself. Any formal assessment would depend on authorization, the way the assets were obtained, communications between the parties, and the laws that apply. No U.S. regulator or law enforcement agency had announced action tied to the withdrawal at the time of publication.
Bridge remains paused as questions continue
Liquid is a federated Bitcoin sidechain developed by Blockstream, where users lock BTC through a peg system and receive L-BTC on a one-to-one basis. After detecting the transaction, Liquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals while developers investigated and applied a patch.
The network has not said when bridge services and L-BTC operations will return to normal. It also has not disclosed whether the 3,400 BTC repayment fully restores backing for the affected L-BTC supply or how it would address any shortfall linked to the 598.5 BTC still under the actors’ control.
The next confirmed step is still pending: Blockstream has not yet published the promised technical explanation of the flaw, and there is no public confirmation that the remaining Bitcoin will be returned. Until then, exchanges are still being asked to keep L-BTC deposits and withdrawals suspended.
Source: crypto.news