The āWhite hatā party that withdrew nearly 4,000 bitcoin from the Liquid Network federation wallet on Sunday returned 3,400 BTC to the wallet on Monday. About 598 BTC, or 15% of the consolidated pile, stayed at the same holder address as an implied bounty fee worth 48 million dollars. The return transaction (bc49a46d), confirmed at 16:09 UTC on September 7.
5 BTC change back to the āWhite hatā hacker address as change. The transfer followed a day of messages written into Bitcoin blocks. The White hats first published transaction on chain with a message in the OP_RETURN arbitrary data field ācontact us on chainā; the message came from the address holding the 4000 BTC taken from the Liquid Network.
A Blockstream-linked address answered with āPlease contact [email protected]ā. Later notes from that sender carried Electrum-encrypted payloads and PGP signatures that can be verified against Blockstreamās published security key. In block 965869, the White hats asked in the clear text whether sending āmostā back to the federation script was acceptable.
The 1,000-sat output on that transaction was only a message carrier. Soon after, the White hats wrote āPlease fix the bug first. The chain is under risk at latest commit right now.
Make sure every node is patched. ā followed by an encrypted blurb of text to Blockstreamās PGP key. ā Hours later, the same Blockstream posted another clear-text note: āBridge nodes are patched, safe to return the fundsā.
Minutes after the 3,400 BTC landed. The white hats sent back 85% of the funds, keeping 15% as an implied finderās fee. The choice was celebrated by some on X as ābetter than keeping 100%ā while others were a bit shocked at the amount.
While 15% might sound reasonable, the total sum is so large that it nears $50 million at todayās prices. Blockstream was clearly not happy about the finderās fee, as four encrypted messages followed onchain a few hours later, likely after the main fires had been put out at the office and the lawyers had a chance to have a say in the matter. An hour later, one more encrypted message was posted from Blockstream.
The White hats replied with two encrypted messages. Blockstream replied once an hour later. Then the White hats published a simple yet meaningful ā š ā sad face emoji.
This emoji does a lot of work. It suggests that negotiations did not go well over reducing the size of the bounty. Blockstream wizards are clearly ābig madā about the size of that finderās fee.
What exactly was said in those encrypted messages is not known and Blockstream has made no public statements on the matter. But we can only assume the saga is not over. The full chat can be easily followed on this vibe-coded site (by yours truly).
A couple of other researchers are keeping tabs on the conversation and on-chain data, such as Sjorsās GitHub gist and Alex Thorn from Galaxy Research. Liquidās Sunday statement is still the networkās last official account post: purported whitehats withdrew about 4,000 BTC through the SideSwap peg-out path, the PAK itself was not compromised, other issued assets were unaffected, and the sidechain was paused. Liquid and Blockstream had not posted a new statement on the 3,400 BTC return as of this writing.
