The group that drained Blockstream’s Liquid Network on Sunday returned most of the bitcoin on Monday, keeping roughly $47 million for themselves.
The transaction confirmed at 16:09 UTC on 7 September, sending exactly 3,400 BTC back to the Liquid federation’s peg address. The remaining 598.5 BTC stayed at the attackers’ address, which CertiK Alert noted “could potentially be a bounty reward.”
Nobody has confirmed it was agreed to.
The retained amount is exactly 15% of the roughly 4,000 BTC withdrawn on 6 September, and it is worth about $47 million at a bitcoin price near $78,500.
The negotiation happened in Bitcoin blocks
The entire exchange is preserved on the blockchain, which makes this one of the more transparent ransom negotiations on record.
It began when the attackers published a transaction from the address holding the 4,000 BTC with a message written into the OP_RETURN data field: “contact us on chain.”
A Blockstream-linked address replied: “Please contact security@blockstream.com.”
The exchange continued through signed messages embedded in Bitcoin transactions, with the attackers asking Blockstream to confirm the federation address before making any return. Blockstream eventually posted a plaintext update reading, “Bridge nodes are patched, safe to return the funds.”
Minutes later, the 3,400 BTC moved.
Four further encrypted messages appeared from Blockstream after the return, suggesting negotiations over the retained amount continued. The final public response from the attackers was a sad face emoji, written into the blockchain.
The content of the encrypted messages is unknown. Blockstream has not commented on them, and the sequence suggests an attempt to reduce the fee that went nowhere.
Fifteen percent is above the going rate
Crypto has developed an informal convention around this, and 15% sits outside it.
After large exploits, protocols increasingly negotiate with attackers rather than relying on law enforcement, which rarely recovers anything. The attacker returns most of the funds and keeps a percentage as a de facto bug bounty. Typical rates run from low single digits into the low double digits, often with an absolute cap attached.
The percentage here is above that range. The absolute figure has no comparison at all.
No formal bug bounty programme in the industry pays $47 million. Most cap payouts in the low millions, and the largest published rewards across major protocols sit far below eight figures.
There was also no agreement in place. No contract, no prior arrangement, and no guarantee the attackers would have returned anything had Blockstream responded more slowly. The 15% was set by the party holding the funds.
A useful comparison arrived only weeks ago. When AFX Trade lost $24.15 million after attackers compromised its bridge validator keys, the exchange publicly offered a 30% bounty for the return. That was an offer made by the victim. This was a figure taken by the attacker.
Why it moved so fast
The resolution came roughly a day after the initial withdrawal, which is unusually quick for a nine-figure exploit.
The speed appears to have depended on Blockstream fixing the bug fast. The attackers made the return conditional on the vulnerability being patched, and Blockstream deployed updated software and signalled the fix publicly within about 24 hours.
Blockstream attributed the incident to a software bug in Elements, the codebase Liquid runs on, rather than compromised keys. A bug-created batch of 4,000 L-BTC passed SideSwap’s peg-out authorisation checks, prompting the federation to release nearly 3,996 real bitcoin against tokens that had no backing.
Liquid and SideSwap have both stated that the Peg-out Authorization Key was not compromised, nor were any other federation keys.
Liquid is preparing to restart
Blockstream said updated software has been deployed and federation members are preparing a coordinated restart. The network has been paused since Sunday, with exchanges suspending L-BTC deposits and withdrawals.
The federation wallet held around 4,200 BTC before the incident and dropped to a little over 200. The return of 3,400 BTC restores roughly 85% of the backing that was removed.
That leaves a gap. Liquid issues L-BTC against bitcoin held by its federation on a one-to-one basis, and 598.5 BTC of that backing is now permanently with the attackers unless Blockstream covers it.
JAN3 chief executive Samson Mow, a former Blockstream executive, said on Monday that the return followed confirmation the bridge nodes had been patched, that roughly 598 BTC remains outstanding, and that Blockstream continues to engage with the actors.
Neither Blockstream nor Liquid has publicly described the retained bitcoin as a bounty or disclosed any compensation terms. Cointelegraph reported it contacted both companies and received no response before publication.
The label was self-assigned
The term “white hat” is doing considerable work in the coverage of this incident, and it is worth being precise about it.
A white hat is a security researcher who finds a vulnerability and discloses it responsibly. That is not what happened here. The vulnerability was exploited first, $320 million was moved to an address the federation did not control, and a return was negotiated afterwards on terms the party holding the money set.
“White hat” is a label the attacker chose. No external authority conferred it, and Blockstream has never publicly confirmed it.
Whether the retained 598.5 BTC is eventually treated as a negotiated settlement or as proceeds of theft is an open question, and one crypto has never resolved. The industry has drifted into accepting these arrangements because the alternative is usually recovering nothing at all.
The practical outcome is that Liquid got 85% of its reserves back in about a day, which is a better result than most exploits produce. The cost was $47 million and a precedent that the person holding the funds decides what the reward is worth.
FAQ
How much was returned?
3,400 BTC, worth roughly $268 million, sent to the Liquid federation’s peg address at 16:09 UTC on 7 September. The attackers kept 598.5 BTC, about $47 million and exactly 15% of the total withdrawn.
Was the fee agreed?
No agreement has been confirmed. Neither Blockstream nor Liquid has publicly described the retained bitcoin as a bounty or disclosed any terms. CertiK Alert said it “could potentially be a bounty reward.”
Is Liquid back online?
Not yet. Blockstream says updated software has been deployed and federation members are preparing a coordinated restart. The network has been paused since Sunday, with exchanges suspending L-BTC deposits and withdrawals.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making any investment decisions.
