Bitcoin News

Story: 3,400 Bitcoin Recovered by Liquid After White Hats’ On-Chain Negotiation

By Sydney TheCMO

1 / 15

Encrypted Messages in Bitcoin Blocks. It all started with messages exchanged directly through Bitcoin blocks — not by email, not by…

2 / 15

A Bug in Elements Behind the Withdrawal. Where did these 4,000 BTC come from initially? SideSwap mentioned a bug issue in Elements as the…

3 / 15

Four thousand bitcoins vanished. Then 3,400 returned. And 598.5 BTC remain with the White Hats, with no visible final agreement.

4 / 15

The return transaction was confirmed at 16:09 UTC on September 7. Exactly 3,400 BTC landed on the Liquid peg script address, while 598.

5 / 15

It all started with messages exchanged directly through Bitcoin blocks — not by email, not by Telegram, but through the blockchain itself.

6 / 15

In block 965869, the White Hats posted a message asking if returning "most" of the funds to the federation address was acceptable. The wording is vague, likely intentionally.

7 / 15

And the reactions on social media were mixed, to say the least.

8 / 15

Blockstream continued to send encrypted messages after the partial return. The exact content of these exchanges remains unknown — no public statement, nothing.

9 / 15

Related reading: Blockstream's Liquid Network Suspended After 4,000 Bitcoin Bug Drains $320 Million

10 / 15

Where did these 4,000 BTC come from initially? SideSwap mentioned a bug issue in Elements as the origin of the funds withdrawn from the federated wallet.

11 / 15

The White Hats insisted on fixing this bug before returning anything. Logical, in a way — if the flaw remains open, returning the funds is pointless, someone else could do it…

12 / 15

But 598.5 BTC kept is a sum that sparks debate. In the world of classic bug bounties, 15% of such a high amount is outside the usual norms.

13 / 15

Independent researchers closely followed the matter. The GitHub of Sjors and the research by Alex Thorn of Galaxy Research documented the transactions and exchanged messages,…

14 / 15

The entire sequence — withdrawal of funds, on-chain messages, patching of nodes, partial return, failed negotiations — unfolded in a few hours on September 7. Quickly, then.

15 / 15

See also: 4,000 Bitcoin Disappear from Liquid Network as Mysterious Hackers Claim Attack

The Currency Analytics

Want the full story?