$270M in Bitcoin Returned by Alleged 'White Hats' as Liquid Network Eyes Relaunch
The individuals behind the withdrawal have returned 85% of the Bitcoin taken from the Liquid federation wallet in the wake of the security breach.
Self-identified white-hat hackers have sent back 3,400 Bitcoin valued at approximately $270 million to the wallet controlled by the Liquid Federation following their withdrawal of roughly $320 million from the reserves of the Bitcoin sidechain.
Speaking on Monday, Samson Mow, CEO of JAN3 and a former executive at Blockstream, stated that the funds were returned after Blockstream confirmed the compromised bridge nodes had received patches. He indicated that approximately 598 BTC continues to be unaccounted for and that Blockstream maintains ongoing communication with the individuals involved.
The funds were returned following a security breach that occurred on Sunday, during which hackers took approximately 4,000 BTC from the wallet's total holdings of roughly 4,200 BTC. Blockchain records demonstrate that precisely 3,400 BTC was sent back to the address associated with the federation's wallet.
According to Blockstream, updated software has now been rolled out and members of the federation are working toward a synchronized restart. The Liquid network creates L-BTC tokens backed by Bitcoin stored by its federation, meaning the restitution of approximately 85% of the removed Bitcoin restores a significant portion of the collateral that was eliminated during the incident while the halted network prepares to come back online.
Bitcoin return follows onchain negotiations
The initial withdrawal was executed using SideSwap's Peg-out Authorization Key, though both Liquid and SideSwap emphasized that the key itself remained secure and was not breached. According to SideSwap, the L-BTC in question came from a vulnerability in Elements, which is the open-source software that powers Liquid.
Blockstream initiated contact with the individuals responsible by utilizing signed messages that were embedded within Bitcoin transactions. The individuals, who characterized themselves as white hats, indicated they would repatriate the majority of the assets once the security flaw was addressed and all nodes had implemented the patch.
According to Mow, the Liquid network continues to remain offline as Blockstream and federation participants implement additional fixes and security enhancements, address a chain split issue, and work toward ensuring a secure restart. He advised users against sending Bitcoin to Liquid peg-in addresses until the network's relaunch receives official confirmation, while noting that users need not take any other action at this time.
Charles Guillemet, who serves as chief technology officer at Ledger, raised questions about whether the individuals deserve the white-hat designation following the partial restitution. He argued that if the approximately 600 BTC that remains in their possession constitutes a reward that was negotiated via encrypted blockchain communications, the situation appears "more like extortion than white-hat hacking."
Both Blockstream and Liquid have refrained from publicly characterizing the unreturned Bitcoin as a bug bounty or revealing any terms related to repayment. Cointelegraph contacted both organizations seeking comment but had not heard back by the time of publication.