Liquid Network recovered 3,400 BTC after an on-chain exchange with the party described as white hats, while 598.5 BTC remained with that holder.
Bitcoin Magazine reported that the return transaction, identified as bc49a46d, was confirmed at 16:09 UTC on Sept. 7. It sent exactly 3,400 BTC back to the labeled Liquid peg script address and returned 598.5 BTC to the white-hat hacker address as change. The article said that amount represented about 15% of the consolidated pile and was worth $48 million at current prices.
A day of messages written into Bitcoin blocks
Before the transfer back, the two sides communicated by embedding messages in Bitcoin transactions over the course of a day. The first on-chain note came from the address holding the 4,000 BTC taken from the Liquid Network and used the OP_RETURN arbitrary data field to say 「contact us on chain」.
An address linked to Blockstream answered with 「Please contact security@blockstream.com」. Later messages from that sender included Electrum-encrypted payloads and PGP signatures that, according to the report, can be verified against Blockstream’s published security key.
White hats asked for a fix before sending funds back
In block 965869, the white hats asked in clear text whether sending 「most」 of the funds back to the federation script would be acceptable. The 1,000-sat output in that transaction served only as a message carrier.
Soon after, the white hats wrote: 「Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.」 That note was followed by an encrypted message directed to Blockstream’s PGP key.
In the same block, a clear-signed reply from the Blockstream sender said: 「Yes, thank you.」 Hours later, the same sender posted another clear-text note: 「Bridge nodes are patched, safe to return the funds」. Minutes after that, the 3,400 BTC was sent back.
598.5 BTC stayed behind as an implied bounty
After the transfer, the white hats had returned about 85% of the funds and kept about 15% as an implied finder’s fee. The report said some users on X described that outcome as better than keeping 100%, while others were surprised by the size of the amount. It also noted that while 15% may sound reasonable, the retained sum was so large that it approached $50 million at current prices.
The article said Blockstream was clearly unhappy with the size of the finder’s fee. Four encrypted messages appeared on-chain a few hours later. One hour after that, Blockstream posted one more encrypted message. The white hats answered with two encrypted messages. Blockstream replied again an hour later. The white hats then posted a simple 「 」 sad-face emoji.
The report said the encrypted messages are not publicly readable and Blockstream has made no public statement on the matter. It added that the exchange may not be over, but did not provide any public confirmation beyond the on-chain notes.
Liquid’s Sunday statement remains the last official update
The article said the full conversation can be tracked through an on-chain monitoring page. It also mentioned other researchers following the exchange and the related on-chain data, including Sjors’s GitHub gist and Alex Thorn of Galaxy Research.
As of publication, Liquid’s Sunday statement remained the network’s latest official post. That statement said purported white hats withdrew about 4,000 BTC through the SideSwap peg-out path, that the PAK itself was not compromised, that other issued assets were unaffected, and that the sidechain was paused.
The report also said SideSwap had stated that the L-BTC in the original peg-out 「came from an Elements bug.」
At the time of writing, neither Liquid nor Blockstream had published a new statement on the return of the 3,400 BTC.