The exploiters returned 3,400 BTC worth $269.2 million to the Liquid Network federation wallet exactly at Bitcoin block 965,950. However, the self-proclaimed white-hat hacker group is still holding the remaining 598.5 BTC - equivalent to $47 million - in withdrawal-related addresses without providing public clarification.
The incident began on Sunday when a user transferred 4,000 L-BTC to SideSwap’s peg-out service. In response to the initial breach, the Liquid team disabled bridge nodes and requested exchanges suspend L-BTC deposit and withdrawal services during the investigation. This latest partial fund return development revises earlier reports that estimated exploit losses at $320 million.
The unique aspect of this resolution lies in its negotiation process. The Blockstream team and the exploiter communicated purely through a series of messages embedded in on-chain Bitcoin transactions.
Condition to Patch the Flaw
The hacker used transaction memos to set an absolute condition before handing back client funds. “Please fix the bug first… Then we will transfer the money back safely after confirming the fix,” wrote the hacker, urging developers to resolve the security issue first.
Blockstream responded to the demand by issuing a cryptographically signed message. “Bridge nodes are patched, safe to return the funds,” the company replied. Shortly after the security statement was permanently recorded on the blockchain, the exploiter fulfilled their promise and returned the 3,400 BTC portion.
The company emphasized that all network private keys remained intact and were not leaked to outside parties. Although the patching process has been verified on the open network, Blockstream’s internal team has yet to publish a technical post-mortem dissecting the root vulnerability.
A Fine Line Between Savior and Extortionist
The core issue now centers on the absence of a formal agreement between the two parties. Blockstream had never announced a public bounty program allowing bug finders to claim rewards of nearly 600 BTC.
The hacker’s decision to withhold assets without a contractual basis immediately drew sharp criticism from industry experts. Ledger Chief Technology Officer Charles Guillemet openly rejected the white-hat label claimed by the exploiter. “600 BTC are still held. If this was ever a reward negotiated via on-chain encrypted contracts, it feels more like extortion than white-hat hacking,” he stated.
The hacker’s action of absconding with client assets without consent clouds their claims of good faith in saving the ecosystem. While the return of the bulk of funds brings relief to the network provider, the loss of $47 million proves that direct negotiations with hackers without a written agreement risk compromising end users. Reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
