White hat hackers returned 3,400 BTC to the Liquid Network federation wallet on Monday, a day after pulling nearly 4,000 BTC from the sidechain. The transaction confirmed at 16:09 UTC on September 7, with the white hats keeping 598.5 BTC — roughly $48 million — as an implied finder's fee. Blockstream had patched the bridge nodes before the funds came back.
The return and the fee
The white hats sent back 85% of the funds they took, keeping the remaining 15% as a bounty. Blockstream confirmed that the bridge nodes were patched and safe for fund return, after which the white hats made the transfer. The 598.5 BTC they kept is worth approximately $48 million at current prices.
On-chain negotiations
The white hats communicated with Blockstream via OP_RETURN messages in Bitcoin blocks, using encrypted payloads and PGP signatures. Blockstream expressed dissatisfaction with the finder's fee through those encrypted messages, and the exchange ended with a sad face emoji from the white hats.
Liquid and SideSwap weigh in
Liquid's official statement said the white hats withdrew about 4,000 BTC via the SideSwap peg-out path, that the PAK was not compromised, other issued assets were unaffected, and the sidechain was paused. SideSwap stated that the L-BTC in the original peg-out came from an Elements bug.
Unresolved fee dispute
As of writing, Liquid and Blockstream had not posted a new statement about the 3,400 BTC return. The finder's fee remains a point of contention, with Blockstream's dissatisfaction made clear on-chain.
