Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC
White hats returned 3,400 BTC to the Liquid federation after on-chain negotiations, keeping 598.5 BTC — roughly $48 million — as an implied bounty.
2 min
Written with AI assistance from the reporting linked below, and reviewed before publication. How we write
Bitcoin Magazine — Mining reports that the party identifying itself as “white hats” returned 3,400 BTC to the Liquid Network federation wallet on 7 September at 16:09 UTC, one day after withdrawing nearly 4,000 BTC through the SideSwap peg-out path. The return left 598.5 BTC — 15 percent of the consolidated pile, worth roughly $48 million at current prices — at the holder address as an implied bounty fee. For site operators and hosting providers, the episode underscores counterparty risk in federated sidechains: a pause on the Liquid sidechain and a nine-figure negotiation conducted in public Bitcoin blocks can move market sentiment and, by extension, hashprice before any official statement lands.
Withdrawal and partial return
The initial withdrawal occurred on Sunday, 6 September. Liquid’s Sunday statement, still the network’s last official account post as of the Bitcoin Magazine — Mining writing, said the PAK itself was not compromised, other issued assets were unaffected, and the sidechain was paused. SideSwap attributed the L-BTC in the original peg-out to an Elements bug. The return transaction, identified as bc49a46d, sent exactly 3,400 BTC back to the labeled Liquid peg script address and routed the 598.5 BTC change back to the white-hat address.
On-chain negotiation
The transfer followed a day of messages written into Bitcoin blocks via OP_RETURN fields. The white hats opened with “contact us on chain” from the address holding the 4,000 BTC. A Blockstream-linked address replied with a support email. Subsequent messages carried Electrum-encrypted payloads and PGP signatures verifiable against Blockstream’s published security key.
In block 965,869 the white hats asked whether sending “most” back to the federation script was acceptable. They then demanded a bug fix before returning funds: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.” A clear-signed reply from the Blockstream sender read “Yes, thank you.” Hours later Blockstream posted “Bridge nodes are patched, safe to return the funds.” Minutes after that note, the 3,400 BTC landed.
Fee dispute and encrypted fallback
The 15 percent bounty — near $50 million — drew mixed reaction on X. Some called it “better than keeping 100%”; others were shocked at the absolute amount. Blockstream was “clearly not happy,” per Bitcoin Magazine — Mining.
Four encrypted messages from Blockstream followed a few hours after the return, then one more an hour later. The white hats replied with two encrypted messages. Blockstream replied once more an hour after that. The white hats then published a single “🙁” emoji, which the outlet interprets as a sign that negotiations over reducing the bounty did not go well. No public statement from Blockstream has been issued, and the encrypted contents remain unknown.
Watch for a formal Liquid or Blockstream statement on the bug root cause, the patch status of all federation nodes, and whether the remaining 598.5 BTC moves — either returned, sold, or used to fund a bug-bounty program — as each outcome will signal how federated pegs handle large-scale white-hat events.