Hackers who drained roughly 4,000 bitcoin from Blockstream's Liquid sidechain have sent back 3,400 of it, leaving about 600 BTC — worth around $47 million at current prices — still outstanding. Blockstream is now negotiating with the group, which claims to be 'white hats,' though that label is drawing skepticism.
The Return and the Shortfall
The return brings the stolen haul down to a fraction of its original size, but the remaining 600 BTC is no small sum. At today's exchange rate, that's roughly $47 million that hasn't come back. The hackers have not explained why they returned most of the funds but not all of them, and Blockstream hasn't said whether the partial return was part of a deal or a goodwill gesture.
The Liquid sidechain, operated by Blockstream, is designed to speed up bitcoin transactions between exchanges and other institutions. The hack hit the sidechain's core infrastructure, forcing Blockstream to pause operations while it assessed the damage. The company has been tight-lipped about the technical details, but the scale of the theft — 4,000 BTC — made it one of the larger crypto heists of the year.
A 'White Hat' Claim Under Scrutiny
The group behind the attack has described itself as 'white hats' — a term usually reserved for security researchers who find vulnerabilities and return stolen assets rather than keep them. But some in the crypto community aren't buying it. The label has been used before by hackers who returned funds only after negotiations, and the fact that 600 BTC remains unreturned raises questions about their motives.
If the group were purely altruistic, the thinking goes, they'd have sent everything back. Instead, they're holding onto a significant chunk while talking to Blockstream. That looks less like a rescue and more like a bargaining chip.
Blockstream's Negotiating Position
Blockstream has confirmed it's in talks with the group over the return of the remaining funds. The company hasn't disclosed the terms of those discussions, or whether a bounty or reward is on the table. What's clear is that the ball is now in the hackers' court — they've shown they can return bitcoin, and the question is what they want in exchange for the last 600 BTC.
The negotiations are unusual because the attackers are anonymous. Blockstream is effectively bargaining with a pseudonymous entity, which makes trust hard to establish. The company has said it's focused on recovering the funds, but it hasn't given a timeline for when the talks might conclude.
Blockstream hasn't said when the negotiations might wrap up, or whether the outstanding 600 BTC will be returned. The group's claim to be acting in good faith has not been independently verified, and the crypto world is watching to see if the remaining millions come back — or if they vanish for good.
