Purported white-hat hackers returned 3,400 Bitcoin worth about $270 million to the Liquid Federation wallet after withdrawing roughly $320 million from the Bitcoin sidechain’s reserves. 

On Monday, JAN3 CEO and former Blockstream executive Samson Mow said the return followed confirmation from Blockstream that the affected bridge nodes had been patched. He said about 598 BTC remains outstanding and that Blockstream continues to engage with the actors.

The return follows a Sunday security incident in which hackers withdrew about 4,000 BTC from the wallet’s roughly 4,200 BTC. Onchain records show that exactly 3,400 BTC was transferred back to the federation’s wallet address. 

Blockstream said updated software had been deployed and federation members were preparing for a coordinated restart. Liquid issues L-BTC against Bitcoin held by its federation, so the return of about 85% of the withdrawn Bitcoin restores much of the backing removed in the incident as the paused network prepares to resume operations. 

Bitcoin return follows onchain negotiations

The original withdrawal was processed through SideSwap’s Peg-out Authorization Key, although Liquid and SideSwap said the key itself was not compromised. SideSwap said the L-BTC involved originated from a bug in Elements, the open-source software underpinning Liquid. 

Blockstream contacted the actors through signed messages embedded in Bitcoin transactions. The actors, who identified themselves as white hats, said they would return most of the funds once the vulnerability was fixed and every node had installed the patch. 

Related: Satoshi-era Bitcoin wakes after 16 years of dormancy as 600 BTC moves

Mow said Liquid remained paused while Blockstream and federation members made further fixes and security improvements, resolved a chain split and prepared for a safe restart. He told users not to send Bitcoin to Liquid peg-in addresses until the network’s restart is confirmed, adding that no user action was otherwise required. 

Ledger chief technology officer Charles Guillemet questioned the actors’ white-hat description after the partial return. He said that if the roughly 600 BTC still under their control represented a reward negotiated through encrypted onchain communications, the arrangement looked “more like extortion than white-hat hacking.”

Neither Blockstream nor Liquid publicly described the outstanding Bitcoin as a bounty or disclosed any repayment terms. Cointelegraph reached out to both companies for comments but did not receive a response before publication. 

Magazine: ‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest

French corporate Bitcoin treasury firm Capital B has added 376 BTC to its balance sheet after completing a new round of fundraising. The company says it purchased the tokens for €25.3 million (about $29.5 million), bringing its total holdings to 3,521 BTC.

According to a Capital B announcement released Monday, the purchase was financed following capital raises totaling roughly €30.1 million (about $35 million), including a private placement backed by investors Adam Back and TOBAM. Swissquote Bank Europe executed the trade, with Taurus providing custody.

Key takeaways

• Capital B bought 376 BTC for €25.3 million, lifting its corporate treasury to 3,521 BTC.
• The acquisition was funded by about €30.1 million in capital raises, including a private placement supported by Adam Back and TOBAM.
• The company paid an average of €67,182 per BTC on this purchase; custody was handled by Taurus.
• Capital B’s latest buy is its largest since September 2025, when it acquired 551 BTC.
• While some corporate holders have reduced positions, other treasury firms—including Metaplanet and H100 Group—continue to add BTC.

Capital B’s latest treasury purchase

Capital B’s newly acquired 376 BTC represents a fresh expansion of its Bitcoin treasury, funded through the company’s recent funding activity. In its Monday filing and accompanying announcement, the company stated that the purchase price averaged €67,182 per BTC.

The execution and custody details add operational clarity for investors tracking corporate Bitcoin strategies. Swissquote Bank Europe carried out the acquisition, while Taurus is listed as the custody provider for the company’s Bitcoin holdings.

Where the company stands among corporate Bitcoin holders

Capital B also provided context on how the new purchase fits into its broader acquisition history. The company said it has spent a total of €309.4 million acquiring its Bitcoin portfolio, at an average cost of €87,878 per BTC.

Using rankings compiled by BitcoinTreasuries.net, the latest buying activity moved Capital B to 25th among publicly traded companies by Bitcoin holdings. The new total of 3,521 BTC places Capital B slightly ahead of Sweden-based H100 Group, which held 3,506 BTC after its earlier increase, though both remain behind Germany’s Bitcoin Group SE, which is reported to have 3,605 BTC.

Big buy since September 2025, but operational BTC is separated

The 376 BTC addition is Capital B’s largest purchase since September 2025, when the firm acquired 551 BTC for €54.7 million. That comparison matters for readers because it indicates a return to scale after a longer period without an equally large ticket size.

Capital B also distinguishes between treasury assets and operational holdings. The company says it holds an additional 61 BTC for operational purposes, which it keeps separate from its treasury reserve and excludes from its Bitcoin performance-related metrics. This separation is important when assessing reported results, since it clarifies that the treasury figures used for performance monitoring are not simply a blanket count of all BTC held.

Corporate accumulation continues even as some firms unwind

The Capital B purchase lands amid a mixed corporate landscape for Bitcoin treasuries. The article notes that some companies have moved to unwind Bitcoin holdings, including references to filings from firms such as K Wave Media and Sequans Communications. Against that backdrop, several other corporate players continue to accumulate.

Japan-based Metaplanet, for example, acquired 2,823 BTC during the second quarter for approximately $222 million, according to Cointelegraph reporting. Metaplanet’s holdings were stated at 43,000 BTC after that purchase, and BitcoinTreasuries.net rankings place the firm as the third-largest publicly traded corporate holder behind Strategy and Twenty One Capital.

Earlier activity also underscores the regional competition for BTC. In August, Sweden-based H100 Group more than tripled its Bitcoin exposure after an all-share deal involving Norwegian companies that held 2,455 BTC. That transaction increased H100’s treasury to 3,506 BTC, making it Europe’s second-largest publicly traded corporate holder at the time—until Capital B’s latest buy slightly closed the gap.

Meanwhile, Strategy—widely regarded as the largest corporate Bitcoin holder—resumed purchasing in August following a two-month pause. Cointelegraph previously reported that Strategy acquired 4,603 BTC for $370 million, lifting holdings to 845,050 BTC, acquired for a combined $63.3 billion. Together, these examples illustrate that corporate demand remains active even when individual companies choose to reduce exposure.

What to watch next

With Capital B scaling its treasury again after its September 2025 high, investors should watch whether the company sustains this pace of acquisitions and how it continues to structure funding rounds—particularly given the role of private placements and named backers in financing purchases. The next signal will likely come from whether Capital B schedules additional large buys or maintains a steadier, smaller accumulation strategy.

Polish prosecutors investigating the troubled crypto exchange Zondacrypto have filed formal criminal charges against an individual identified as Romana Ż., accusing him of involvement in an organized criminal group and of misappropriating approximately 7.8 million zlotys (about $2.1 million) in user funds. Prosecutors also requested that the Katowice-Wschód District Court order pretrial detention, arguing that the suspect could flee or attempt to disrupt the investigation, according to an official statement from Poland’s National Prosecutor’s Office.

According to the filing, Romana Ż. was detained on Sept. 5 and later questioned by prosecutors. The suspect denied the accusations and submitted a statement, the announcement said. Prosecutors’ motion for detention will be considered by the court.

Key takeaways

• Prosecutors accuse Romana Ż. of participating in an organized criminal group and misappropriating about 7.8 million zlotys from exchange user funds.
• The case focuses on alleged unauthorized computer-record changes and interference with how Zondacrypto processed and transmitted exchange data.
• Prosecutors seek pretrial detention, citing risks of flight and evidence or investigation interference.
• The new charges build on earlier arrests in the Zondacrypto probe, where multiple suspects were also ordered held in custody.
• Broader investigations tied to the exchange have expanded over time, including a probe connected to Sylwester Suszek and BitBay’s later transition to Zondacrypto.

What prosecutors say Romana Ż. did

In their official announcement, prosecutors alleged that Romana Ż. worked with others to misappropriate funds entrusted to Zondacrypto. The accusation centers on alleged manipulation of computer records without authorization and interference with the processing and transmission of exchange data.

The prosecution’s request for pretrial detention reflects practical concerns beyond the underlying allegations. Prosecutors argued that keeping the suspect free could increase the risk he would not appear for proceedings, or could otherwise interfere with the investigation, according to the Monday announcement. The court’s decision will be relevant to how quickly the case proceeds and whether investigators can broaden or refine their evidence package.

Earlier arrests and custody requests in the same investigation

These charges follow the prosecution’s earlier action in the broader Zondacrypto investigation. On Sept. 2, three other individuals were detained and subsequently charged with allegations that included money laundering, misappropriation of company assets, and participation in an organized criminal group.

Polish authorities said a court ordered all three to be held in pretrial detention for up to three months. Together with the Romana Ż. filing, this suggests prosecutors are pursuing the case as a coordinated matter rather than treating it as a set of isolated incidents.

For market participants, such steps typically matter because they can signal to investors that the case is moving from preliminary inquiries into a more evidence-driven phase. They can also affect how quickly affected parties seek restitution, particularly when user funds are involved and the exchange’s operational structure has already collapsed.

How the Zondacrypto probe widened over time

Earlier coverage from Cointelegraph noted that prosecutors estimated total losses connected to Zondacrypto at no less than 350 million zlotys. The current charges against Romana Ż. do not change that larger figure in the provided material, but they add detail on a specific alleged component of the overall misconduct: manipulation of exchange-related records and disruption of data handling.

Cointelegraph also previously reported that the investigation was merged in July with a separate probe involving the 2022 disappearance of Sylwester Suszek, the founder of BitBay, which was later renamed Zondacrypto. While the newly detailed allegations relate to unauthorized changes to computer records and interference with exchange data processing, the procedural merger indicates investigators have been looking across multiple threads connected to the same corporate and operational history.

This is one of the reasons the case is being watched closely: when investigations are consolidated, it can reduce the chance that key evidence or patterns remain fragmented across separate legal tracks.

Bankruptcy proceedings continue in parallel

Outside the criminal investigation, Zondacrypto’s corporate operator has also been drawn into a formal insolvency process. The exchange’s Estonian operator, BB Trade Estonia, was declared bankrupt in August, with the first creditors’ meeting scheduled for Sept. 17, according to the information provided.

While the criminal case and insolvency proceedings are distinct, they can interact in important ways. Criminal proceedings may affect how evidence is characterized and what claims can be pursued by creditors and affected users, while insolvency proceedings are typically where restitution and asset recovery efforts move forward—often on a separate timeline.

For users trying to understand recovery prospects, the practical takeaway is that the bankruptcy process is already underway, and criminal charges can shape the long-term narrative of alleged conduct—without necessarily determining the pace or outcome of creditor negotiations in the near term.

What happens next

Readers should watch for the Katowice-Wschód District Court’s decision on prosecutors’ request for pretrial detention, as well as any subsequent charges as the case develops. With bankruptcy proceedings scheduled to move into the next phase and the investigation spanning multiple alleged misconduct theories, the coming weeks are likely to determine both how fast the criminal matter progresses and how creditors interpret the scale of alleged losses.

Ethereum developer Derek Chiang said on Sept. 7 that EIP-8141’s authors had found a way to express several transaction features as programmable contract calls instead of adding them separately to Ethereum’s transaction envelope.

Chiang, an EIP-8141 co-author and Ethlabs contributor, described the development as a “design breakthrough” in a post discussing recent work by the proposal’s authors. The approach treats transaction expiry, aggregate signatures, privacy-pool Merkle roots and post-transaction assertions as calls called “frames.”

The official draft specification defines a Frame Transaction as a sequence of contract calls. Different frames can validate a transaction, approve its gas payment or execute user operations. The proposal currently provides three modes: DEFAULT, VERIFY and SENDER.

A VERIFY frame can check whether a required condition is satisfied. A SENDER frame executes an operation from the account identified as the transaction sender. Frames can also be grouped into atomic batches, meaning every operation in a batch succeeds together or the entire group reverts.

The proposal still defines a base transaction envelope containing fields such as the chain identifier, nonce, sender, fees, signatures and frame list. Chiang’s point is narrower: developers may be able to introduce more functionality through new frame targets and call patterns without creating another envelope format for every feature.

A stable envelope could reduce coordination work

Changing an Ethereum transaction envelope affects more than execution clients. Wallets, Layer 2 networks, block explorers, signing devices, software libraries and infrastructure providers must all understand the new format.

Chiang said Ethereum upgrades occur roughly every nine months, making repeated envelope changes slow and coordination-heavy. A sufficiently general frame format could serve as a stable interface while contracts or designated protocol components provide new validation methods.

That does not mean future functionality would never require a network upgrade. EIP-8141 itself changes Ethereum’s consensus rules and requires client implementation. New opcodes, precompiles or gas rules could also require hard forks. The proposed benefit is that developers would not necessarily need to redesign the transaction container each time.

The EIP-8141 specification lists native account abstraction among its main goals. It could support key rotation, alternative signature systems, sponsored gas payments and transaction batching. It also aims to reduce Ethereum accounts’ dependence on the secp256k1 signature system used by conventional externally owned accounts.

As crypto.news reported in its coverage of Vitalik Buterin’s proposed Ethereum transaction redesign, programmable validation could eventually help Ethereum adopt new authentication systems without replacing one fixed signature scheme with another.

EIP-8130 could make frames easier to inspect

Chiang also acknowledged a tradeoff. Highly abstract transactions can become difficult for wallets, sequencers and other infrastructure to analyze before execution. An Layer 2 sequencer might, for example, want to accept only specified signature methods because their computational costs are predictable.

Developers are therefore exploring how frames could work with EIP-8130, another draft account-abstraction proposal. EIP-8130 creates an onchain keystore where accounts register actors and authenticator contracts. Transactions explicitly identify their authentication method.

That structure allows a node to determine which validation process a transaction requires before running arbitrary wallet code. Under EIP-8130’s proposed Layer 2 profile, a chain could restrict its transaction path to a canonical set of fixed-cost authenticators while leaving other authentication methods available through ordinary EVM execution.

Chiang said EIP-8130 could impose defined structures over EIP-8141 frames. The collaboration could preserve the flexibility of frames while giving wallets and high-throughput chains a more legible transaction format. The combined design has not been finalized, and both specifications remain open to revision.

Earlier crypto.news coverage examined the competition between EIP-8141 and EIP-8130 during the initial Hegotá scoping process. The latest comments suggest developers are now looking for compatible elements rather than treating the proposals only as mutually exclusive alternatives.

Buterin connects frames with parallel validation

Vitalik Buterin expanded on the technical direction in a separate post, distinguishing between transaction “actions” and “dependencies.” An action changes Ethereum’s state, such as transferring ETH. A dependency is a condition that must be satisfied, such as a signature, Merkle proof or zero-knowledge proof.

Buterin argued that independent dependencies could be checked in parallel. Conditions that do not access Ethereum state could potentially be processed once by the mempool instead of being repeated during execution. Multiple checks might eventually be represented by a recursive STARK proof, although that remains a research direction rather than an approved feature.

The distinction could also help clients separate predictable transactions from operations requiring Ethereum’s full dynamic execution environment. Buterin said more statically analyzable activity could receive lower gas costs and scale further. No such fee schedule has been approved.

The frame model provides a potential interface for that approach because validation and execution appear as identifiable calls. Ethereum would retain flexible contract execution while allowing simpler transactions to declare more information about their requirements.

EIP-8141 is scheduled, but dates remain open

The official Hegotá Meta EIP now lists Frame Transactions and FOCIL as scheduled for inclusion in Ethereum’s Hegotá upgrade. That represents stronger status than earlier consideration, but it does not freeze EIP-8141’s current technical design.

EIP-8141 remains marked as a draft Core proposal. Its authors can revise the frame modes, signature handling, gas accounting and relationship with EIP-8130 as implementation work continues. The Hegotá document also leaves the Sepolia, Hoodi and mainnet activation fields blank.

The next measurable steps include updated specifications, execution-client implementations, development networks and interoperability testing with wallets and Layer 2 systems. Developers must also examine mempool denial-of-service risks because programmable validation can make rejecting invalid transactions more computationally expensive.

Testing will determine whether the proposed combination of flexible frames and structured authenticators can meet the needs of Ethereum’s base layer and faster EVM chains. Until activation parameters are published, EIP-8141 remains a scheduled but unfinished part of Hegotá.

Amid a shift in capital flows from Wall Street, US spot XRP ETFs recorded net inflows for 11 consecutive trading days, attracting a total of approximately $170 million during that period. 

Recent data indicates that since the launch of these products, US spot XRP ETFs have seen cumulative net inflows of around $1.68 billion. What do these inflows signify? The sustained influx of capital has heightened market focus on the long-term investment value of XRP, prompting many holders to consider a question: beyond simply waiting for asset appreciation, is it possible to generate additional returns on these digital assets while holding them?

From “holding XRP” to “growing asset value”

As US spot XRP ETFs continue to attract capital, XRP is emerging as an asset of interest for both institutional and individual investors in the cryptocurrency market. For the growing number of long-term XRP holders, generating additional returns from their digital assets has become a key priority. Against this backdrop, FTMINING is gaining attention among XRP holders. Rather than simply waiting for price appreciation, investors are increasingly exploring ways to generate extra cash flow through digital asset yield models. While the market remains bullish on XRP’s growth potential, FTMINING’s digital asset management and cloud computing platform offers XRP holders a reliable source of passive income. Users can achieve continuous asset appreciation through an intelligent computing system and daily earnings settlements, all without the need for complex operations.

Mining services provided by FTMINING

A model of participating in digital asset mining through remote computing power. Users do not need to purchase mining machines, deploy equipment or maintain mines by themselves. They only need to choose the appropriate computing power solution, and professional mines will be responsible for equipment operation, operation and maintenance management and mining operations. Users will receive corresponding mining benefits based on the purchased computing power.

The FTMINING platform is powered by new or clean energy sources such as hydropower, wind power, and photovoltaics, which not only improves energy utilization efficiency, but also helps reduce operating costs and carbon emissions. Compared with the traditional self-built mine model, cloud mining has lower investment threshold, convenient operation, no need to maintain equipment, and it is easy for novices to participate.

FTMINING getting started guide:

Visit the official website: https://ftmining.com

[ Register Account ] ──> [ Select Contract ] ──> [ System Allocates Hashrate ] ──> [ Automatic Payouts ]

(Quick email sign-up)    (Choose currency & term)    (Remote miner connection)    (Daily earnings settled to wallet)

1. Visit the official website: https://ftmining.com. New users receive a $15 sign-up bonus and a $0.75 reward for logging in daily.

2. The platform supports BTC, ETH, LTC, USDT, USDC, XRP, SOL, DOGE, and BCH, eliminating complex currency conversions and making deposits and withdrawals more convenient.

3. Choose the best contract plan; FTMINING offers a variety of contracts to meet different budget and goal requirements. Whether you are seeking short-term gains or long-term returns, we have the right option for you.

(For further details regarding the contract, please visit the official website.)

4. Once the contract is activated, your earnings will accumulate automatically, allowing you to use the service with confidence. The platform automatically records your earnings on a daily basis, and you can monitor changes in real-time via your mobile phone.

FTMINING: A safe, transparent, and trustworthy investment

Founded in 2021 and headquartered in the UK, FTMINING is an innovative platform specializing in digital asset management and cloud computing services. It operates within the regulatory frameworks of the UK and the EU, adhering to principles of compliance, security, and transparency, while undergoing regular financial and security audits by third-party organizations.

Technologically, the platform employs multiple security mechanisms—including bank-grade firewalls, cloud security certifications, multi-signature cold wallets, and asset segregation systems—to provide multi-layered protection for user funds.

Conclusion

Continued capital inflows into US XRP spot ETFs are further boosting market interest in XRP. Meanwhile, digital asset holders are increasingly seeking yield opportunities beyond mere passive income and capital appreciation. Through the FTMINING platform, investors can generate steady passive income amidst market volatility and achieve dual-layer asset growth, offering an innovative and sustainable investment pathway for long-term investors.

For XRP holders looking to explore yield-generating models for their digital assets, FTMINING presents a compelling option worth considering.

Official Website:https://ftmining.com

Customer Support Email: [email protected]

XRP Healthcare said 4,011 XRPH Wallet accounts were affected by unauthorized transactions beginning Sept. 3, with approximately $452,000 in XRP and related assets removed.

XRP Healthcare traces stolen funds to Ethereum

XRP Healthcare initially confirmed unauthorized transactions involving XRP, XRPH, XRPHAI and other assets. The company instructed users to stop using XRPH Wallet until further notice while its developers investigated the compromise.

A subsequent update placed the affected wallet count at approximately 4,011 and the estimated loss at $452,000. The company said investigators traced the assets to one Ethereum address and contacted exchanges and other parties about freezing or recovering them.

Independent on-chain researcher Handy Andy reported that the affected accounts lost 267,664 XRP and approximately 23.2 million XRPH tokens. The researcher said the assets were converted into roughly 445,198 DAI on Ethereum and remained in the destination wallet at the time of the update.

Investigators examine a possible seed phrase leak

Independent investigators attributed the XRPH Wallet breach to its staking function. Their analysis alleged that activating staking caused users’ seed phrases to be transmitted to a remote server.

XRP Healthcare had not published source code, server logs or an independent forensic report confirming that explanation when this article was prepared. The seed phrase exposure therefore remains a researcher finding rather than a company-confirmed root cause.

A seed phrase provides control over every private key generated by a wallet. Anyone obtaining it can reproduce the wallet and authorize transactions without accessing the victim’s phone. Crypto.news previously explained how seed phrases function as master recovery keys and why they should never leave the user’s secure environment.

The reported failure resembles a July incident in which a compromised software package transmitted private keys through a fraudulent telemetry function. However, no evidence currently connects the two cases or their perpetrators.

Former Ripple developers revive earlier concerns

The breach prompted public criticism from developers previously associated with Ripple and the XRP Ledger ecosystem. BiasGoose said he had rejected an earlier grant application from the project because the application showed what he considered clear warning signs.

He later alleged that the team had misrepresented partnerships in its application. Hazard Cookie said earlier reviewers had identified risks that were not publicly visible at the time.

Former Ripple developer Matt Hamilton also referred to the project’s earlier reputation within the community. These statements represent the developers’ accounts. Public grant records or complete audit documents substantiating every allegation were not available.

XRP Healthcare rejected the tone of the criticism and accused former developers of celebrating another team’s losses. Its response called that conduct “genuinely pathetic” and said the company had put its own reputation and capital at risk. The exchange did not resolve the technical questions surrounding the wallet.

Users need new wallets before moving remaining assets

XRP Healthcare must now establish the precise entry point, determine when seed information may have been exposed and identify which application versions were affected. A full postmortem should also explain whether the reported server retained seed phrases and who could access them.

Users who created or imported seed phrases into the affected application cannot rely solely on an app update if those phrases were exposed. Remaining funds should be transferred to newly generated wallets using trusted software. Reusing an old seed would preserve the attacker’s access.

The company has not announced a reimbursement program or recovery deadline. It also has not confirmed whether law enforcement or any exchange successfully froze the traced funds. Users should rely on official channels and reject unsolicited recovery offers requesting keys, seed phrases or payments.

The incident follows a wider rise in wallet and infrastructure compromises. As crypto.news reported, operational security failures caused 74% of stolen funds during the first half of 2026. Separately, Ripple’s recent audit program identified 96 vulnerabilities across proposed XRPL amendments, showing the value of testing before software reaches users.