Purported white-hat hackers who withdrew roughly $320 million in Bitcoin from the Liquid Network's federation wallet say they will return "most" of the funds, but only once Blockstream fixes the bug that let them in. The two sides have been negotiating publicly on-chain since Sunday, and skepticism remains over whether the hackers deserve the "white hat" label at all.
Purported white-hat hackers behind the roughly $320 million Liquid Network security incident are willing to return "most" of the nearly 4,000 BTC they withdrew, but not until Blockstream fixes the vulnerability that let the withdrawal happen. The unusual pledge surfaced during an on-chain conversation between the unidentified party and Blockstream, according to Galaxy Research head Alex Thorn.
How the funds left Liquid
The episode began on Sunday, when roughly 4,000 BTC, or about 95% of the Bitcoin pegged into the sidechain, moved out of the Liquid Federation wallet. Liquid said the funds were withdrawn using the SideSwap Peg-out Authorization Key, though the key itself was not compromised and no other keys were put at risk.
As a result, Liquid disabled its bridge nodes and paused the network. Separately, exchanges have suspended, or are preparing to suspend, LBTC deposits and withdrawals. Other assets on the network, including USDT, DePix and real-world assets, were not affected.
A negotiation carried out on-chain
The hacker's opening message read: "we are whitehats. contact us on chain." Rather than email, the exchange has run through Bitcoin OP_RETURN messages and PGP-encrypted text.
According to Thorn's reconstruction, Blockstream established contact at Bitcoin block 965,822, sending 1,000 satoshis alongside an OP_RETURN message, then followed up with an encrypted, PGP-signed transmission to the hacker's key, whose signature Thorn said matched Blockstream's published public key. The hacker then responded at block 965,869 by moving their own balance and sending 1,000 satoshis back to the federation's peg wallet, asking whether returning most of the funds to a specified address would be acceptable.
However, the hacker said the money would not move until every node on the network had been patched. As of 9:12 PM PDT, around 3,998.5 BTC remained unmoved.
Skepticism over the "white hat" label
Ledger Chief Technology Officer Charles Guillemet initially argued that conventional white hats do not typically drain hundreds of millions of dollars from a bridge. He drew comparisons to the Ronin hack, in which attackers stole around $625 million, and the Euler exploit. He softened that view once the hacker began engaging with Blockstream, noting that criminal groups rarely try to contact their victims.
Liquid itself continues to describe the party behind the withdrawal only as "purported" white-hat hackers, and almost all of the withdrawn Bitcoin remains under their control.
Sources: U.Today, CryptoPotato
Trading involves risk.
Risk Disclaimer
