Key Highlights
- The white hat has sent back 3,400 BTC, worth about $268 million, to the Liquid Federation after the security incident.
- The actor kept 598.5 BTC, worth around $47 million, which represents about 15% of the nearly 4,000 BTC involved in the incident.
- CertiK Alert said the 15% kept by the white hat could potentially be a bounty reward, although there is no confirmation that Liquid or Blockstream agreed to this payment.
A purported white-hat actor linked to the Liquid Network incident has returned 3,400 Bitcoin (BTC), worth about $268 million, to the Liquid Federation while keeping 598.5 BTC valued at roughly $47 million.
CertiK Alert reported the return on September 7, noting that the retained amount represents 15% of the nearly 4,000 BTC involved and could potentially serve as a bounty reward.
The return followed a series of on-chain messages between the actors and Blockstream over the conditions for returning the Bitcoin.
The actors had earlier called themselves “whitehats” and used messages placed directly on the Bitcoin blockchain to contact Blockstream. Their messages showed that they were willing to return most of the funds, but they first wanted Blockstream to fix the security problem that allowed the Bitcoin to leave the Liquid system.
The actors ask for a security fix
The talks started after nearly 4,000 BTC was withdrawn from the Liquid Federation wallet on September 6. The actors later sent a message asking Blockstream to confirm the wallet address where the Bitcoin should be sent.
They also asked the company to make sure the vulnerability had been fixed before they moved the funds back.
Blockstream then confirmed that the needed security work had been completed. At 09:19:46 UTC on September 7, a Blockstream message recorded on the Bitcoin blockchain said, “Bridge nodes are patched, safe to return the funds.”
The actor later replied by asking Blockstream to confirm the Liquid Federation address again before making the return.
3,400 BTC moves back to liquid
That confirmation was followed by the movement of Bitcoin. The white hat eventually sent 3,400 BTC back to the Liquid Federation, leaving approximately 598.6 BTC under its control. The retained Bitcoin is about 15% of the total amount involved.
Certik Alert said this “could potentially be a bounty reward,” but the information available does not confirm that the parties formally agreed to such a payment.
How the liquid incident started
The incident began on September 6, when roughly 4,000 BTC, worth about $320 million at the time, was withdrawn from the Liquid Federation wallet. Liquid said the withdrawal was made through SideSwap’s Peg-out Authorization Key, or PAK. However, Liquid said the PAK had not been compromised and that its other federation keys were not compromised either.
SideSwap said a customer had sent about 4,000 L-BTC to its peg-out service at around 14:05 UTC. The L-BTC was then burned using a valid peg-out authorization, after which the federation released approximately 3,996 BTC.
The money later became part of the on-chain discussion between the actors and Blockstream. The actors first said they were “sending most back,” then paused the return while asking Blockstream to patch every affected node. They also shared encrypted information about the vulnerability.
Blockstream later traced the problem to a bug in Elements, the open-source software used by Liquid. SideSwap also said neither its own systems nor its PAK had been compromised.
With 3,400 BTC now returned, the latest development leaves 598.5 BTC still with the white-hat actor. The return marks a major change from the earlier stage of the incident, when almost 4,000 BTC remained outside the Liquid Federation wallet while both sides worked out how the funds could safely be returned.
Also Read: David Hoffman’s ETH Exit Draws Attention as LIT Surges
