The attacker who drained roughly 4,000 bitcoin from the Liquid Network said they will give back most of the funds once the software bug that made the theft possible is patched. The promise, made in a statement, puts the ball in the developers' court.
A conditional promise
The attacker said they would return most of the stolen bitcoin, but only after the network's software bug is fixed. They didn't say how much of the 4,000 BTC would be returned, or when. The condition is clear: no patch, no return.
That leaves the network's future tied to a technical fix. The attacker's statement offers no timeline for the patch, and no details on how the funds would be transferred back. It's a promise with strings attached.
The bug and the network
Liquid is a Bitcoin sidechain, a separate ledger that lets users move bitcoin faster and with more privacy. The bug allowed the attacker to take the coins, and the incident has raised questions about the security of sidechains in general.
The network has been under scrutiny since the theft. The attacker's willingness to return most of the funds, conditional on a patch, suggests they want the underlying issue fixed, not just the money back. But the damage to trust may already be done.
What happens next
The patch is now the key. Developers need to identify the exact flaw, write a fix, test it, and deploy it across the network. That process could take days or weeks. Until then, the roughly 4,000 bitcoin sit in the attacker's control.
The attacker's promise is a rare move in the world of crypto heists, where stolen funds usually vanish into mixers and tumblers. But it's also a reminder that the return depends entirely on the software being fixed. If the patch never ships, the promise is empty.
The clock is now on the developers. Until the patch is live, the funds remain out of reach, and the attacker's word is all the community has to hold onto.
