Purported white hat hackers returned 3,400 Bitcoin (BTC) to Liquid Network, leaving about 598 BTC worth roughly $47 million outstanding.
Key Points:
- The group sent back 85% of the roughly 4,000 BTC drained from Liquid's federation wallet over the weekend.
- Liquid stays paused while its operators finish security work, unwind a chain split and restore full backing for L-BTC.
- Ledger's chief technology officer questions whether the 598 BTC left behind can honestly be called a bug bounty.
Liquid Network Returns 3,400 Bitcoin To Federation
Onchain records confirmed the return, showing exactly 3,400 BTC sent to the federation's peg address at 16:09 UTC on Monday, a little more than a day after the coins vanished.
The two sides bargained in public first, writing short messages into Bitcoin transactions, and the hackers refused to move anything until every node in the network carried the fix. The money landed once Blockstream said the bridge was patched.
Samson Mow, the JAN3 chief executive and former Blockstream executive who has been relaying updates on the incident, said Monday that roughly 598 BTC remains outstanding and that discussions with the group continue. He asked holders to send nothing to Liquid peg-in addresses until a restart is confirmed.
Operators had already disabled bridge nodes, halted the sidechain and told exchanges around the market to freeze L-BTC deposits and withdrawals.
The coins that came back were worth close to $270 million, roughly 85% of the $320 million drained from the network over the weekend. Other Liquid assets went untouched, including Tether (USDT) and tokenized real-world assets.
Also Read: Banks Sell Crypto While Rejecting Balance Sheet Risk In Brazil
Charles Guillemet Questions White Hat Label
Charles Guillemet, chief technology officer at Ledger, has doubted the white hat framing since the first hours of the incident.
He compared the withdrawal to the Ronin bridge theft, which cost roughly $625 million and was later tied to North Korean operators, and he pointed to Euler as well. After the partial return, he said the coins kept back would look "more like extortion than white-hat hacking" if they represented a reward negotiated in encrypted messages. Neither Blockstream nor Liquid has called the outstanding Bitcoin a bounty.
The dispute matters because Liquid rests on a single promise, that every L-BTC in circulation is matched one for one by real Bitcoin locked in a wallet the federation controls. Operators must also unwind a chain split before any restart counts as safe.
Trouble started Sunday, when roughly 4,000 BTC left a federation wallet that had held about 4,200, stripping L-BTC of its full backing inside half an hour and leaving fewer than 200 coins behind. The withdrawal ran through SideSwap's peg-out service, which burned 4,000 L-BTC under a valid authorization key at 14:05 UTC and drew a federation payout 23 minutes later. Blockstream traced the tokens to a bug in Elements, the open-source software the sidechain runs on.
Read Next: Robinhood Chain Flips Solana For The First Time With $1.45B In Daily DEX Volume
