Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin's public record shows. About 598.5 bitcoin has not come back.
Liquid is a Bitcoin sidechain that holds real bitcoin to back a token called L-BTC. The network is still paused, so holders cannot turn that token back into bitcoin.
The 3,400 bitcoin was sent to a Liquid Federation address at 16:09 UTC on September 7, about 85% of what was taken. The federation is the group of operators that holds the bitcoin backing L-BTC.
The remaining 598.5 bitcoin was not a separate payment. It is the change from that same transaction, sent back to the address the funds had come from. It was still there on September 8, according to the block explorer mempool.space.
Neither Blockstream nor Liquid Network has said publicly whether that bitcoin is part of an agreement.
In an incident notice, Blockstream, which provides the technology for Liquid, said hackers who claim to be white hats took about 4,000 bitcoin from the federation wallet. It put the value at about $320 million at the time.
The withdrawal took roughly 95% of Liquid's reported bitcoin reserves, which stood at about 4,200 bitcoin beforehand, The Block reported.
At a bitcoin price of about $78,000 on September 8, the 3,400 bitcoin were worth roughly $265 million, and the 598.5 bitcoin were worth about $47 million.
The bitcoin was sent via SideSwap's Peg-out Authorization Key, one of the keys that release funds from the sidechain. That key "was not compromised, nor were any others," Blockstream said.
A peg-out destroys L-BTC on the sidechain and releases the matching bitcoin on the main Bitcoin chain. SideSwap said a bug in Elements had created the L-BTC used in that withdrawal, the software Liquid runs on, Unchained reported. SideSwap also said neither its systems nor its key were compromised.
Liquid did not explain the flaw when it announced the incident, and Blockstream's incident page does not describe it.
The two sides then talked in public, on the Bitcoin blockchain. An early message written into a transaction read "we are whitehats. contact us on chain," The Block reported.
The group asked for the flaw to be fixed and every node patched before it would send anything back, Unchained reported. Blockstream replied with a signed message saying its bridge nodes were patched and the funds were safe to return.
A transaction confirmed at 15:31 UTC on September 7 sent the federation address 1,000 satoshis, or 0.00001 bitcoin, along with a PGP-encrypted message written into it. The contents of that message are not public. The 3,400 bitcoin followed, confirmed 38 minutes later.
Blockstream said updated software has been deployed and that federation members are preparing a coordinated restart, Unchained reported. Samson Mow, chief executive of JAN3 and a former Blockstream executive, put the amount not returned at about 598 bitcoin. He said Blockstream is still in contact with the group.
As of September 8, Blockstream's status page still listed the incident as active with its public bridge nodes down, and had not been updated to mention the return. It does not say how much bitcoin now backs L-BTC.
Mow told users not to send bitcoin to Liquid's peg-in addresses, the deposit addresses that create L-BTC, until the restart is confirmed. Other assets issued on Liquid, including USDT and DePix, are unaffected, Blockstream said.
Not everyone accepts the white-hat description. Charles Guillemet, chief technology officer at Ledger, rejected the label, Unchained reported. He said that if the roughly 600 bitcoin still held was a reward negotiated through encrypted messages on the blockchain, the arrangement looked more like extortion.