Purported white-hat hackers returned 3,400 Bitcoin worth about $270 million to the Liquid Federation wallet after withdrawing roughly $320 million from the Bitcoin sidechain’s reserves. 

On Monday, JAN3 CEO and former Blockstream executive Samson Mow said the return followed confirmation from Blockstream that the affected bridge nodes had been patched. He said about 598 BTC remains outstanding and that Blockstream continues to engage with the actors.

The return follows a Sunday security incident in which hackers withdrew about 4,000 BTC from the wallet’s roughly 4,200 BTC. Onchain records show that exactly 3,400 BTC was transferred back to the federation’s wallet address. 

Blockstream said updated software had been deployed and federation members were preparing for a coordinated restart. Liquid issues L-BTC against Bitcoin held by its federation, so the return of about 85% of the withdrawn Bitcoin restores much of the backing removed in the incident as the paused network prepares to resume operations. 

Bitcoin return follows onchain negotiations

The original withdrawal was processed through SideSwap’s Peg-out Authorization Key, although Liquid and SideSwap said the key itself was not compromised. SideSwap said the L-BTC involved originated from a bug in Elements, the open-source software underpinning Liquid. 

Blockstream contacted the actors through signed messages embedded in Bitcoin transactions. The actors, who identified themselves as white hats, said they would return most of the funds once the vulnerability was fixed and every node had installed the patch. 

Related: Satoshi-era Bitcoin wakes after 16 years of dormancy as 600 BTC moves

Mow said Liquid remained paused while Blockstream and federation members made further fixes and security improvements, resolved a chain split and prepared for a safe restart. He told users not to send Bitcoin to Liquid peg-in addresses until the network’s restart is confirmed, adding that no user action was otherwise required. 

Ledger chief technology officer Charles Guillemet questioned the actors’ white-hat description after the partial return. He said that if the roughly 600 BTC still under their control represented a reward negotiated through encrypted onchain communications, the arrangement looked “more like extortion than white-hat hacking.”

Neither Blockstream nor Liquid publicly described the outstanding Bitcoin as a bounty or disclosed any repayment terms. Cointelegraph reached out to both companies for comments but did not receive a response before publication. 

Magazine: ‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest

French corporate Bitcoin treasury firm Capital B has added 376 BTC to its balance sheet after completing a new round of fundraising. The company says it purchased the tokens for €25.3 million (about $29.5 million), bringing its total holdings to 3,521 BTC.

According to a Capital B announcement released Monday, the purchase was financed following capital raises totaling roughly €30.1 million (about $35 million), including a private placement backed by investors Adam Back and TOBAM. Swissquote Bank Europe executed the trade, with Taurus providing custody.

Key takeaways

• Capital B bought 376 BTC for €25.3 million, lifting its corporate treasury to 3,521 BTC.
• The acquisition was funded by about €30.1 million in capital raises, including a private placement supported by Adam Back and TOBAM.
• The company paid an average of €67,182 per BTC on this purchase; custody was handled by Taurus.
• Capital B’s latest buy is its largest since September 2025, when it acquired 551 BTC.
• While some corporate holders have reduced positions, other treasury firms—including Metaplanet and H100 Group—continue to add BTC.

Capital B’s latest treasury purchase

Capital B’s newly acquired 376 BTC represents a fresh expansion of its Bitcoin treasury, funded through the company’s recent funding activity. In its Monday filing and accompanying announcement, the company stated that the purchase price averaged €67,182 per BTC.

The execution and custody details add operational clarity for investors tracking corporate Bitcoin strategies. Swissquote Bank Europe carried out the acquisition, while Taurus is listed as the custody provider for the company’s Bitcoin holdings.

Where the company stands among corporate Bitcoin holders

Capital B also provided context on how the new purchase fits into its broader acquisition history. The company said it has spent a total of €309.4 million acquiring its Bitcoin portfolio, at an average cost of €87,878 per BTC.

Using rankings compiled by BitcoinTreasuries.net, the latest buying activity moved Capital B to 25th among publicly traded companies by Bitcoin holdings. The new total of 3,521 BTC places Capital B slightly ahead of Sweden-based H100 Group, which held 3,506 BTC after its earlier increase, though both remain behind Germany’s Bitcoin Group SE, which is reported to have 3,605 BTC.

Big buy since September 2025, but operational BTC is separated

The 376 BTC addition is Capital B’s largest purchase since September 2025, when the firm acquired 551 BTC for €54.7 million. That comparison matters for readers because it indicates a return to scale after a longer period without an equally large ticket size.

Capital B also distinguishes between treasury assets and operational holdings. The company says it holds an additional 61 BTC for operational purposes, which it keeps separate from its treasury reserve and excludes from its Bitcoin performance-related metrics. This separation is important when assessing reported results, since it clarifies that the treasury figures used for performance monitoring are not simply a blanket count of all BTC held.

Corporate accumulation continues even as some firms unwind

The Capital B purchase lands amid a mixed corporate landscape for Bitcoin treasuries. The article notes that some companies have moved to unwind Bitcoin holdings, including references to filings from firms such as K Wave Media and Sequans Communications. Against that backdrop, several other corporate players continue to accumulate.

Japan-based Metaplanet, for example, acquired 2,823 BTC during the second quarter for approximately $222 million, according to Cointelegraph reporting. Metaplanet’s holdings were stated at 43,000 BTC after that purchase, and BitcoinTreasuries.net rankings place the firm as the third-largest publicly traded corporate holder behind Strategy and Twenty One Capital.

Earlier activity also underscores the regional competition for BTC. In August, Sweden-based H100 Group more than tripled its Bitcoin exposure after an all-share deal involving Norwegian companies that held 2,455 BTC. That transaction increased H100’s treasury to 3,506 BTC, making it Europe’s second-largest publicly traded corporate holder at the time—until Capital B’s latest buy slightly closed the gap.

Meanwhile, Strategy—widely regarded as the largest corporate Bitcoin holder—resumed purchasing in August following a two-month pause. Cointelegraph previously reported that Strategy acquired 4,603 BTC for $370 million, lifting holdings to 845,050 BTC, acquired for a combined $63.3 billion. Together, these examples illustrate that corporate demand remains active even when individual companies choose to reduce exposure.

What to watch next

With Capital B scaling its treasury again after its September 2025 high, investors should watch whether the company sustains this pace of acquisitions and how it continues to structure funding rounds—particularly given the role of private placements and named backers in financing purchases. The next signal will likely come from whether Capital B schedules additional large buys or maintains a steadier, smaller accumulation strategy.

Polish prosecutors investigating the troubled crypto exchange Zondacrypto have filed formal criminal charges against an individual identified as Romana Ż., accusing him of involvement in an organized criminal group and of misappropriating approximately 7.8 million zlotys (about $2.1 million) in user funds. Prosecutors also requested that the Katowice-Wschód District Court order pretrial detention, arguing that the suspect could flee or attempt to disrupt the investigation, according to an official statement from Poland’s National Prosecutor’s Office.

According to the filing, Romana Ż. was detained on Sept. 5 and later questioned by prosecutors. The suspect denied the accusations and submitted a statement, the announcement said. Prosecutors’ motion for detention will be considered by the court.

Key takeaways

• Prosecutors accuse Romana Ż. of participating in an organized criminal group and misappropriating about 7.8 million zlotys from exchange user funds.
• The case focuses on alleged unauthorized computer-record changes and interference with how Zondacrypto processed and transmitted exchange data.
• Prosecutors seek pretrial detention, citing risks of flight and evidence or investigation interference.
• The new charges build on earlier arrests in the Zondacrypto probe, where multiple suspects were also ordered held in custody.
• Broader investigations tied to the exchange have expanded over time, including a probe connected to Sylwester Suszek and BitBay’s later transition to Zondacrypto.

What prosecutors say Romana Ż. did

In their official announcement, prosecutors alleged that Romana Ż. worked with others to misappropriate funds entrusted to Zondacrypto. The accusation centers on alleged manipulation of computer records without authorization and interference with the processing and transmission of exchange data.

The prosecution’s request for pretrial detention reflects practical concerns beyond the underlying allegations. Prosecutors argued that keeping the suspect free could increase the risk he would not appear for proceedings, or could otherwise interfere with the investigation, according to the Monday announcement. The court’s decision will be relevant to how quickly the case proceeds and whether investigators can broaden or refine their evidence package.

Earlier arrests and custody requests in the same investigation

These charges follow the prosecution’s earlier action in the broader Zondacrypto investigation. On Sept. 2, three other individuals were detained and subsequently charged with allegations that included money laundering, misappropriation of company assets, and participation in an organized criminal group.

Polish authorities said a court ordered all three to be held in pretrial detention for up to three months. Together with the Romana Ż. filing, this suggests prosecutors are pursuing the case as a coordinated matter rather than treating it as a set of isolated incidents.

For market participants, such steps typically matter because they can signal to investors that the case is moving from preliminary inquiries into a more evidence-driven phase. They can also affect how quickly affected parties seek restitution, particularly when user funds are involved and the exchange’s operational structure has already collapsed.

How the Zondacrypto probe widened over time

Earlier coverage from Cointelegraph noted that prosecutors estimated total losses connected to Zondacrypto at no less than 350 million zlotys. The current charges against Romana Ż. do not change that larger figure in the provided material, but they add detail on a specific alleged component of the overall misconduct: manipulation of exchange-related records and disruption of data handling.

Cointelegraph also previously reported that the investigation was merged in July with a separate probe involving the 2022 disappearance of Sylwester Suszek, the founder of BitBay, which was later renamed Zondacrypto. While the newly detailed allegations relate to unauthorized changes to computer records and interference with exchange data processing, the procedural merger indicates investigators have been looking across multiple threads connected to the same corporate and operational history.

This is one of the reasons the case is being watched closely: when investigations are consolidated, it can reduce the chance that key evidence or patterns remain fragmented across separate legal tracks.

Bankruptcy proceedings continue in parallel

Outside the criminal investigation, Zondacrypto’s corporate operator has also been drawn into a formal insolvency process. The exchange’s Estonian operator, BB Trade Estonia, was declared bankrupt in August, with the first creditors’ meeting scheduled for Sept. 17, according to the information provided.

While the criminal case and insolvency proceedings are distinct, they can interact in important ways. Criminal proceedings may affect how evidence is characterized and what claims can be pursued by creditors and affected users, while insolvency proceedings are typically where restitution and asset recovery efforts move forward—often on a separate timeline.

For users trying to understand recovery prospects, the practical takeaway is that the bankruptcy process is already underway, and criminal charges can shape the long-term narrative of alleged conduct—without necessarily determining the pace or outcome of creditor negotiations in the near term.

What happens next

Readers should watch for the Katowice-Wschód District Court’s decision on prosecutors’ request for pretrial detention, as well as any subsequent charges as the case develops. With bankruptcy proceedings scheduled to move into the next phase and the investigation spanning multiple alleged misconduct theories, the coming weeks are likely to determine both how fast the criminal matter progresses and how creditors interpret the scale of alleged losses.

Ethereum developer Derek Chiang said on Sept. 7 that EIP-8141’s authors had found a way to express several transaction features as programmable contract calls instead of adding them separately to Ethereum’s transaction envelope.

Chiang, an EIP-8141 co-author and Ethlabs contributor, described the development as a “design breakthrough” in a post discussing recent work by the proposal’s authors. The approach treats transaction expiry, aggregate signatures, privacy-pool Merkle roots and post-transaction assertions as calls called “frames.”

The official draft specification defines a Frame Transaction as a sequence of contract calls. Different frames can validate a transaction, approve its gas payment or execute user operations. The proposal currently provides three modes: DEFAULT, VERIFY and SENDER.

A VERIFY frame can check whether a required condition is satisfied. A SENDER frame executes an operation from the account identified as the transaction sender. Frames can also be grouped into atomic batches, meaning every operation in a batch succeeds together or the entire group reverts.

The proposal still defines a base transaction envelope containing fields such as the chain identifier, nonce, sender, fees, signatures and frame list. Chiang’s point is narrower: developers may be able to introduce more functionality through new frame targets and call patterns without creating another envelope format for every feature.

A stable envelope could reduce coordination work

Changing an Ethereum transaction envelope affects more than execution clients. Wallets, Layer 2 networks, block explorers, signing devices, software libraries and infrastructure providers must all understand the new format.

Chiang said Ethereum upgrades occur roughly every nine months, making repeated envelope changes slow and coordination-heavy. A sufficiently general frame format could serve as a stable interface while contracts or designated protocol components provide new validation methods.

That does not mean future functionality would never require a network upgrade. EIP-8141 itself changes Ethereum’s consensus rules and requires client implementation. New opcodes, precompiles or gas rules could also require hard forks. The proposed benefit is that developers would not necessarily need to redesign the transaction container each time.

The EIP-8141 specification lists native account abstraction among its main goals. It could support key rotation, alternative signature systems, sponsored gas payments and transaction batching. It also aims to reduce Ethereum accounts’ dependence on the secp256k1 signature system used by conventional externally owned accounts.

As crypto.news reported in its coverage of Vitalik Buterin’s proposed Ethereum transaction redesign, programmable validation could eventually help Ethereum adopt new authentication systems without replacing one fixed signature scheme with another.

EIP-8130 could make frames easier to inspect

Chiang also acknowledged a tradeoff. Highly abstract transactions can become difficult for wallets, sequencers and other infrastructure to analyze before execution. An Layer 2 sequencer might, for example, want to accept only specified signature methods because their computational costs are predictable.

Developers are therefore exploring how frames could work with EIP-8130, another draft account-abstraction proposal. EIP-8130 creates an onchain keystore where accounts register actors and authenticator contracts. Transactions explicitly identify their authentication method.

That structure allows a node to determine which validation process a transaction requires before running arbitrary wallet code. Under EIP-8130’s proposed Layer 2 profile, a chain could restrict its transaction path to a canonical set of fixed-cost authenticators while leaving other authentication methods available through ordinary EVM execution.

Chiang said EIP-8130 could impose defined structures over EIP-8141 frames. The collaboration could preserve the flexibility of frames while giving wallets and high-throughput chains a more legible transaction format. The combined design has not been finalized, and both specifications remain open to revision.

Earlier crypto.news coverage examined the competition between EIP-8141 and EIP-8130 during the initial Hegotá scoping process. The latest comments suggest developers are now looking for compatible elements rather than treating the proposals only as mutually exclusive alternatives.

Buterin connects frames with parallel validation

Vitalik Buterin expanded on the technical direction in a separate post, distinguishing between transaction “actions” and “dependencies.” An action changes Ethereum’s state, such as transferring ETH. A dependency is a condition that must be satisfied, such as a signature, Merkle proof or zero-knowledge proof.

Buterin argued that independent dependencies could be checked in parallel. Conditions that do not access Ethereum state could potentially be processed once by the mempool instead of being repeated during execution. Multiple checks might eventually be represented by a recursive STARK proof, although that remains a research direction rather than an approved feature.

The distinction could also help clients separate predictable transactions from operations requiring Ethereum’s full dynamic execution environment. Buterin said more statically analyzable activity could receive lower gas costs and scale further. No such fee schedule has been approved.

The frame model provides a potential interface for that approach because validation and execution appear as identifiable calls. Ethereum would retain flexible contract execution while allowing simpler transactions to declare more information about their requirements.

EIP-8141 is scheduled, but dates remain open

The official Hegotá Meta EIP now lists Frame Transactions and FOCIL as scheduled for inclusion in Ethereum’s Hegotá upgrade. That represents stronger status than earlier consideration, but it does not freeze EIP-8141’s current technical design.

EIP-8141 remains marked as a draft Core proposal. Its authors can revise the frame modes, signature handling, gas accounting and relationship with EIP-8130 as implementation work continues. The Hegotá document also leaves the Sepolia, Hoodi and mainnet activation fields blank.

The next measurable steps include updated specifications, execution-client implementations, development networks and interoperability testing with wallets and Layer 2 systems. Developers must also examine mempool denial-of-service risks because programmable validation can make rejecting invalid transactions more computationally expensive.

Testing will determine whether the proposed combination of flexible frames and structured authenticators can meet the needs of Ethereum’s base layer and faster EVM chains. Until activation parameters are published, EIP-8141 remains a scheduled but unfinished part of Hegotá.