Community Trust ScoreVerified
Four thousand bitcoins vanished. Then 3,400 returned. And 598.5 BTC remain with the White Hats, with no visible final agreement.
The return transaction was confirmed at 16:09 UTC on September 7. Exactly 3,400 BTC landed on the Liquid peg script address, while 598.5 BTC returned to the address of the group that had withdrawn the funds from Liquid’s federated wallet. These 598.5 BTC represent about 15% of the initial total — what the White Hats kept, officially as a discovery fee. No signed agreement. No press release. Just an on-chain transaction and a sad emoji posted by the White Hats at the end of the exchanges.
Fifteen percent. That’s significant.
Encrypted Messages in Bitcoin Blocks
It all started with messages exchanged directly through Bitcoin blocks — not by email, not by Telegram, but through the blockchain itself. The group of White Hats contacted Blockstream this way, and Blockstream responded by indicating to go through “[email protected]”. Subsequent exchanges included encrypted payloads and verifiable PGP signatures, the kind of communication used when traceability and authenticity are desired.
In block 965869, the White Hats posted a message asking if returning “most” of the funds to the federation address was acceptable. The wording is vague, likely intentionally. Blockstream replied a few hours later: the bridge nodes had been fixed, and the funds could be safely returned. With that, the White Hats executed the transfer — 85% returned, 15% retained.
And the reactions on social media were mixed, to say the least.
Blockstream continued to send encrypted messages after the partial return. The exact content of these exchanges remains unknown — no public statement, nothing. What is known is that the two parties could not agree on reducing the reward. The negotiations ended with that sad emoji posted by the White Hats. Not exactly a sign of mutual agreement.
A Bug in Elements Behind the Withdrawal
Where did these 4,000 BTC come from initially? SideSwap mentioned a bug issue in Elements as the origin of the funds withdrawn from the federated wallet. Elements is the open-source protocol on which Liquid is built. A bug in there, and funds can move without the usual control mechanisms functioning properly.
The White Hats insisted on fixing this bug before returning anything. Logical, in a way — if the flaw remains open, returning the funds is pointless, someone else could do it again. Blockstream patched the bridge nodes, and only after that did the return transfer occur.
But 598.5 BTC kept is a sum that sparks debate. In the world of classic bug bounties, 15% of such a high amount is outside the usual norms. It’s unclear if Blockstream had an official reward program covering this kind of scenario.
Independent researchers closely followed the matter. The GitHub of Sjors and the research by Alex Thorn of Galaxy Research documented the transactions and exchanged messages, offering rare visibility into this type of incident. Without them, much of the technical details would have remained opaque to the general public.
The entire sequence — withdrawal of funds, on-chain messages, patching of nodes, partial return, failed negotiations — unfolded in a few hours on September 7. Quickly, then. And rather well documented thanks to the public nature of the blockchain.
Neither Liquid nor Blockstream has issued new statements after the confirmation of the return of the 3,400 BTC. No official comment on the 598.5 BTC retained, no details on potential future actions. Internal discussions are likely ongoing — or not. Impossible to say.
What is certain: 598.5 BTC remain with the White Hats, the sad emoji is there to prove it, and Blockstream has not said a word publicly since.
Frequently Asked Questions
How many BTC did Liquid recover in this operation?
Liquid recovered exactly 3,400 BTC out of the nearly 4,000 bitcoins initially withdrawn from its federated wallet by the White Hats on September 7.
Why did the White Hats keep 598.5 BTC?
The White Hats retained 598.5 BTC — about 15% of the total — as a discovery fee for identifying and reporting the vulnerability in Liquid’s bridge nodes.
What bug caused this incident on Liquid?
SideSwap mentioned a bug issue in Elements, the open-source protocol on which Liquid is built, as the origin of the withdrawal of funds from the federated wallet.
Why It Matters
This incident highlights the ongoing challenges of security and trust within the cryptocurrency ecosystem, particularly for custodial solutions like Liquid. The recovery of 3,400 BTC demonstrates the complexities involved in on-chain negotiations and the role of ethical hackers, or "White Hats," in mitigating losses from security breaches. As the remaining funds still withheld raise questions about accountability and the motivations behind such recoveries, this situation could influence investor sentiment and regulatory scrutiny surrounding custodial practices in the crypto markets.
