"we are whitehats. contact us on chain," read an early message the intruders placed on the Bitcoin blockchain — a line that prefaced the partial return of a vast trove of bitcoin taken from the Liquid Network.
The return: 3,400 bitcoin sent back to the Liquid Federation
On September 7 at 16:09 UTC, 3,400 bitcoin were moved from the address controlled by whoever withdrew funds from Liquid and deposited to a Liquid Federation address, Bitcoin's public ledger shows. That amount represents roughly 85% of the nearly 4,000 bitcoin removed on September 6, a withdrawal Blockstream described as carried out by "hackers who claim to be white hats." Blockstream put the total taken at about 4,000 bitcoin, valuing the initial haul at roughly $320 million at the time.
The remaining 598.5 bitcoin and the transaction mechanics
About 598.5 bitcoin were not returned. Blockchain analysis shows that this sum was the change output from the same transaction that sent the 3,400 bitcoin back — meaning it was not a separate payment but the residual output returned to the originating address and seen there on September 8 via the mempool.space block explorer. At a bitcoin price of about $78,000 on September 8, the 3,400 bitcoin were worth roughly $265 million and the 598.5 bitcoin about $47 million.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildElements bug and SideSwap's peg-out authorization
Liquid runs on the Elements software. SideSwap, the owner of the peg-out Authorization Key used to release bitcoin from the sidechain, said a bug in Elements "created the L-BTC used in that withdrawal," according to reporting by Unchained. SideSwap added that neither its systems nor its key were compromised. Blockstream said the peg-out Authorization Key that executed the transfer "was not compromised, nor were any others." Liquid remains paused, meaning holders cannot convert L-BTC back into bitcoin while the network is inactive.
On-chain negotiation and proof-of-intent messages
The interaction between the takers and Liquid's operators unfolded publicly on Bitcoin's ledger. An earlier transaction confirmed at 15:31 UTC on September 7 carried 1,000 satoshis (0.00001 bitcoin) and included a PGP-encrypted message embedded in the transaction; the contents of that encrypted text are not public. According to reporting in The Block and Unchained, the group demanded that the flaw be fixed and every node patched before returning funds. Blockstream replied, via a signed message, that its bridge nodes had been patched and that funds were safe to return — after which the 3,400 bitcoin were transferred back 38 minutes later.
Responses from Blockstream, Liquid, Samson Mow, and Ledger
- Blockstream said it has deployed updated software and that federation members are preparing a coordinated restart, as reported by Unchained. Its incident page did not describe the technical flaw, and as of September 8 Blockstream's status page still listed the incident as active with public bridge nodes down; that status page had not been updated to note the return and did not state how much bitcoin now backs L-BTC.
- Liquid did not publicly explain the flaw in its incident announcement.
- Samson Mow, chief executive of JAN3 and a former Blockstream executive, put the amount not returned at about 598 bitcoin and said Blockstream remained in contact with the group. Mow advised users not to send bitcoin to Liquid's peg-in addresses — the deposit points that create L-BTC — until a coordinated restart is confirmed.
- Charles Guillemet, chief technology officer at Ledger, rejected the "white-hat" label applied by the takers. Guillemet said that if the roughly 600 bitcoin still held represented a negotiated reward delivered through encrypted blockchain messages, the arrangement "looked more like extortion," according to Unchained.
- Blockstream also said other assets issued on Liquid, including USDT and DePix, were unaffected by the incident.
What this means for federation operators, Elements developers, and Liquid users
- Federation operators: federation members are preparing a coordinated restart and have deployed updated software, but public bridge nodes remained down on Blockstream's status page as of September 8 — leaving restart timing dependent on a confirmed, collective decision.
- Elements developers and SideSwap: SideSwap pointed to an Elements bug that generated the L-BTC used in the withdrawal; developers will face scrutiny on the patching and disclosure process, given that SideSwap said its key and systems were not compromised.
- Liquid users and asset holders: Liquid is paused and L-BTC cannot currently be redeemed for bitcoin; users were specifically warned by Samson Mow not to deposit bitcoin to peg-in addresses until the federation confirms a safe restart.
The public, on-chain dialogue and the partial return of funds resolved much of the immediate threat but left two concrete uncertainties visible in the record: Blockstream's public status page had not acknowledged the return as of September 8, and it did not disclose how much bitcoin currently backs L-BTC. Equally unresolved is whether the retention of roughly 598.5 bitcoin represents a negotiated fee, an agreed-upon reward, or another outcome; the parties themselves have not published such an agreement.
https://thehackernews.com/2026/09/liquid-hackers-return-3400-bitcoin.html
