{"id":50691,"date":"2026-09-07T22:02:19","date_gmt":"2026-09-07T22:02:19","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=50691"},"modified":"2026-09-07T22:02:19","modified_gmt":"2026-09-07T22:02:19","slug":"liquid-gets-3400-btc-back-after-on-chain-talks-white-hats-keep-598-5-btc","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=50691","title":{"rendered":"Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC"},"content":{"rendered":"

Bitcoin Magazine<\/a>
\n
\nLiquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC<\/a><\/p>\n

<\/div>\n

The \u201cWhite hat\u201d party that withdrew nearly 4,000 bitcoin<\/a> from the Liquid Network federation wallet on Sunday returned 3,400 BTC to the wallet on Monday. About 598 BTC, or 15% of the consolidated pile, stayed at the same holder address as an implied bounty fee worth 48 million dollars.<\/p>\n

The return transaction (bc49a46d<\/a>), confirmed at 16:09 UTC on September 7. It returned exactly 3,400 BTC to the labeled Liquid peg script address<\/a> and sent the 598.5 BTC change back to the \u201cWhite hat\u201d hacker address as change.\u00a0<\/p>\n

The transfer followed a day of messages written into Bitcoin blocks. The White hats first published transaction on chain with a message in the OP_RETURN arbitrary data field \u201ccontact us on chain\u201d<\/a>; the message came from the address holding the 4000 BTC taken from the Liquid Network.\u00a0<\/p>\n

A Blockstream-linked address answered with \u201cPlease contact security@blockstream.com\u201d<\/a>. Later notes from that sender carried Electrum-encrypted payloads and PGP signatures that can be verified against Blockstream\u2019s published security key.<\/p>\n

In block 965869, the White hats asked in the clear text whether sending \u201cmost\u201d<\/a> back to the federation script was acceptable. The 1,000-sat output on that transaction was only a message carrier.\u00a0<\/p>\n

Soon after, the White hats wrote<\/a> \u201cPlease fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.\u201d followed by an encrypted blurb of text to Blockstream\u2019s PGP key<\/a>.\u00a0<\/p>\n

In the same block, a clear-signed reply from the Blockstream sender said \u201cYes, thank you.\u201d Hours later, the same Blockstream posted another clear-text note: \u201cBridge nodes are patched, safe to return the funds<\/a>\u201d.\u00a0<\/p>\n

Minutes after the 3,400 BTC landed<\/a>. The white hats sent back 85% of the funds, keeping 15% as an implied finder\u2019s fee. The choice was celebrated by some on X as \u2018better than keeping 100%\u2019 while others were a bit shocked at the amount. While 15% might sound reasonable, the total sum is so large that it nears $50 million at today\u2019s prices. Blockstream was clearly not happy about the finder\u2019s fee, as four encrypted messages followed onchain a few hours later, likely after the main fires had been put out at the office and the lawyers had a chance to have a say in the matter. An hour later, one more encrypted message was posted from Blockstream.<\/p>\n

The White hats replied with two encrypted messages. Blockstream replied once an hour later. Then the White hats published a simple yet meaningful \u201c \"\ud83d\ude41\" \u201d sad face emoji. This emoji does a lot of work. It suggests that negotiations did not go well over reducing the size of the bounty. Blockstream wizards are clearly \u2018big mad\u2019 about the size of that finder\u2019s fee. What exactly was said in those encrypted messages is not known and Blockstream has made no public statements on the matter. But we can only assume the saga is not over.<\/p>\n

\"\"<\/figure>\n

The full chat<\/a> can be easily followed on this vibe-coded site (by yours truly). A couple of other researchers are keeping tabs on the conversation and on-chain data, such as Sjors\u2019s GitHub gist<\/a> and Alex Thorn from Galaxy Research<\/a>.\u00a0<\/p>\n

Liquid\u2019s Sunday statement is still the network\u2019s last official account post: purported whitehats withdrew about 4,000 BTC through the SideSwap peg-out path, the PAK itself was not compromised, other issued assets were unaffected, and the sidechain was paused. Liquid and Blockstream had not posted a new statement on the 3,400 BTC return as of this writing. SideSwap had said the L-BTC in the original peg-out \u201ccame from an Elements bug.\u201d\u00a0<\/p>\n

This post Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC<\/a> first appeared on Bitcoin Magazine<\/a> and is written by Juan Galt<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Bitcoin Magazine Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC The \u201cWhite hat\u201d party that withdrew nearly 4,000 bitcoin from the Liquid Network federation wallet on Sunday returned 3,400 BTC to the wallet on Monday. About 598 BTC, or 15% of the consolidated pile, stayed at the same holder address […]<\/p>\n","protected":false},"author":1,"featured_media":50692,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"footnotes":""},"categories":[45],"tags":[],"class_list":["post-50691","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin"],"yoast_head":"\nLiquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC - Cryptomag<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptomag.finance\/?p=50691\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC - Cryptomag\" \/>\n<meta property=\"og:description\" content=\"Bitcoin Magazine Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC The \u201cWhite hat\u201d party that withdrew nearly 4,000 bitcoin from the Liquid Network federation wallet on Sunday returned 3,400 BTC to the wallet on Monday. About 598 BTC, or 15% of the consolidated pile, stayed at the same holder address […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptomag.finance\/?p=50691\" \/>\n<meta property=\"og:site_name\" content=\"Cryptomag\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-07T22:02:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/bitcoinmagazine.com\/wp-content\/uploads\/2026\/09\/tn-2.webp\" \/>\n<meta name=\"author\" content=\"Crypto Magazine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:site\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Crypto Magazine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50691#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50691\"},\"author\":{\"name\":\"Crypto Magazine\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"headline\":\"Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC\",\"datePublished\":\"2026-09-07T22:02:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50691\"},\"wordCount\":639,\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50691#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/tn-2-JSZnIu.webp\",\"articleSection\":[\"Bitcoin\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50691\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50691\",\"name\":\"Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC - Cryptomag\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50691#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50691#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/tn-2-JSZnIu.webp\",\"datePublished\":\"2026-09-07T22:02:19+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50691#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cryptomag.finance\\\/?p=50691\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50691#primaryimage\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/tn-2-JSZnIu.webp\",\"contentUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/tn-2-JSZnIu.webp\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50691#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cryptomag.finance\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/\",\"name\":\"Cryptomag\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cryptomag.finance\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\",\"name\":\"Crypto Magazine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"caption\":\"Crypto Magazine\"},\"sameAs\":[\"https:\\\/\\\/cryptomag.finance\",\"https:\\\/\\\/x.com\\\/cryptomagz\"],\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC - Cryptomag","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptomag.finance\/?p=50691","og_locale":"en_US","og_type":"article","og_title":"Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC - Cryptomag","og_description":"Bitcoin Magazine Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC The \u201cWhite hat\u201d party that withdrew nearly 4,000 bitcoin from the Liquid Network federation wallet on Sunday returned 3,400 BTC to the wallet on Monday. About 598 BTC, or 15% of the consolidated pile, stayed at the same holder address […]","og_url":"https:\/\/cryptomag.finance\/?p=50691","og_site_name":"Cryptomag","article_published_time":"2026-09-07T22:02:19+00:00","og_image":[{"url":"https:\/\/bitcoinmagazine.com\/wp-content\/uploads\/2026\/09\/tn-2.webp","type":"","width":"","height":""}],"author":"Crypto Magazine","twitter_card":"summary_large_image","twitter_creator":"@cryptomagz","twitter_site":"@cryptomagz","twitter_misc":{"Written by":"Crypto Magazine","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cryptomag.finance\/?p=50691#article","isPartOf":{"@id":"https:\/\/cryptomag.finance\/?p=50691"},"author":{"name":"Crypto Magazine","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"headline":"Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC","datePublished":"2026-09-07T22:02:19+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=50691"},"wordCount":639,"image":{"@id":"https:\/\/cryptomag.finance\/?p=50691#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/tn-2-JSZnIu.webp","articleSection":["Bitcoin"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cryptomag.finance\/?p=50691","url":"https:\/\/cryptomag.finance\/?p=50691","name":"Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC - Cryptomag","isPartOf":{"@id":"https:\/\/cryptomag.finance\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=50691#primaryimage"},"image":{"@id":"https:\/\/cryptomag.finance\/?p=50691#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/tn-2-JSZnIu.webp","datePublished":"2026-09-07T22:02:19+00:00","author":{"@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"breadcrumb":{"@id":"https:\/\/cryptomag.finance\/?p=50691#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptomag.finance\/?p=50691"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptomag.finance\/?p=50691#primaryimage","url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/tn-2-JSZnIu.webp","contentUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/tn-2-JSZnIu.webp","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/cryptomag.finance\/?p=50691#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptomag.finance\/"},{"@type":"ListItem","position":2,"name":"Liquid Gets 3,400 BTC Back After On-Chain Talks; White Hats Keep 598.5 BTC"}]},{"@type":"WebSite","@id":"https:\/\/cryptomag.finance\/#website","url":"https:\/\/cryptomag.finance\/","name":"Cryptomag","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptomag.finance\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040","name":"Crypto Magazine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","caption":"Crypto Magazine"},"sameAs":["https:\/\/cryptomag.finance","https:\/\/x.com\/cryptomagz"],"url":"https:\/\/cryptomag.finance\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/50691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=50691"}],"version-history":[{"count":0,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/50691\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/media\/50692"}],"wp:attachment":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=50691"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=50691"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=50691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}