Written by Ezra Reguerrastaff writerReviewed by Yohan Yunstaff editor

Written by Ezra Reguerrastaff writer

Reviewed by Yohan Yunstaff editor

Liquid ‘white hats’ return $270M in Bitcoin as network prepares restart

Latest NewsPublishedSep 8, 2026

The actors returned 85% of the Bitcoin withdrawn from Liquid’s federation wallet following the security incident.

Purported white-hat hackers returned 3,400 Bitcoin worth about $270 million to the Liquid Federation wallet after withdrawing roughly $320 million from the Bitcoin sidechain’s reserves. 

On Monday, JAN3 CEO and former Blockstream executive Samson Mow stated the return followed confirmation from Blockstream that the affected bridge nodes had been patched. He stated about 598 BTC remains outstanding and that Blockstream continues to engage with the actors.

The return follows a Sunday security incident in which hackers withdrew about 4,000 BTC from the wallet’s roughly 4,200 BTC. Onchain records demonstrate that exactly 3,400 BTC was transferred back to the federation’s wallet address. 

Blockstream stated updated software had been deployed and federation members were preparing for a coordinated restart. Liquid issues L-BTC against Bitcoin held by its federation, so the return of about 85% of the withdrawn Bitcoin restores much of the backing removed in the incident as the paused network prepares to resume operations. 

Bitcoin return follows onchain negotiations

The original withdrawal was processed through SideSwap’s Peg-out Authorization Key, although Liquid and SideSwap stated the key itself was not compromised. SideSwap stated the L-BTC involved originated from a bug in Elements, the open-source software underpinning Liquid. 

Blockstream contacted the actors through signed messages embedded in Bitcoin transactions. The actors, who identified themselves as white hats, stated they would return most of the funds once the vulnerability was fixed and every node had installed the patch. 

Related: Satoshi-era Bitcoin wakes after 16 years of dormancy as 600 BTC moves

Mow stated Liquid remained paused while Blockstream and federation members made further fixes and security improvements, resolved a chain split and prepared for a safe restart. He told users not to send Bitcoin to Liquid peg-in addresses until the network’s restart is verified, adding that no user action was otherwise required. 

Ledger chief technology officer Charles Guillemet questioned the actors’ white-hat description after the partial return. He stated that if the roughly 600 BTC still under their control represented a reward negotiated through encrypted onchain communications, the arrangement looked “more like extortion than white-hat hacking.”

Neither Blockstream nor Liquid publicly described the outstanding Bitcoin as a bounty or disclosed any repayment terms. Cointelegraph reached out to both companies for comments but did not receive a response before publication. 

Magazine: ‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

• Hackers
• Hacks
• Cybersecurity
• Security
• Bitcoin

More on the subject

Capital B adds 376 Bitcoin in $29M purchase, boosting holdings to 3,521 BTC

11 hours ago

Nate Kostar

Yen intervention meets US inflation data: Five things to know in Bitcoin this week

15 hours ago

William Suberg

Bitcoin sidechain Liquid pauses after purported ‘white hats’ withdraw $320M in BTC

22 hours ago

Ezra Reguerra

Capital B adds 376 Bitcoin in $29M purchase, boosting holdings to 3,521 BTC

11 hours ago

Nate Kostar

Yen intervention meets US inflation data: Five things to know in Bitcoin this week

15 hours ago

William Suberg

Bitcoin sidechain Liquid pauses after purported ‘white hats’ withdraw $320M in BTC

22 hours ago

Ezra Reguerra