White-hat wallets return $270M in Bitcoin as network readies restart

Blockstream-backed Liquid has moved closer to resuming normal operations after a partial repayment tied to a Sunday security incident involving the network’s Bitcoin reserves. According to on-chain activity and statements from industry figures, purported “white-hat” actors returned 3,400 BTC—worth about $270 million—to the Liquid Federation wallet after withdrawing roughly $320 million from the Bitcoin sidechain’s reserve.

The return follows Monday comments from JAN3 CEO and former Blockstream executive Samson Mow, who said Blockstream confirmed that the affected bridge nodes had been patched. Mow added that approximately 598 BTC remains outstanding, while Blockstream continues direct engagement with the parties involved.

Key takeaways

• On-chain records indicate exactly 3,400 BTC was transferred back to the Liquid Federation wallet address after a prior withdrawal of about 4,000 BTC.
• Liquid remains paused as bridge-node fixes roll out, with federation members preparing for a coordinated restart.
• Blockstream says updated software has been deployed and that further issues—such as a chain split—must be fully resolved before resuming.
• Liquid’s backing depends on L-BTC issued against Bitcoin held by the federation; returning ~85% of withdrawn BTC restores much of the removed collateral.
• Mow advised users not to send Bitcoin to Liquid peg-in addresses until the restart is confirmed; there is no indication that user actions are otherwise required beyond that guidance.

3,400 BTC returned after bridge-node patch confirmation

In the hours after Sunday’s incident, the immediate focus turned to whether the withdrawn Bitcoin would be recovered. On-chain data shared via transaction records shows 3,400 BTC moved back to the federation’s wallet address, aligning with the portion of funds referenced by Mow and others. The earlier withdrawal had reduced the roughly 4,200 BTC reserve before the network was paused.

Mow said the return came after Blockstream provided confirmation that patch work on the affected bridge nodes was complete. He also stated that about 598 BTC is still not in the federation’s control. Meanwhile, he indicated Blockstream is continuing to work with the actors behind the initial withdrawal.

Liquid’s operational pause matters for more than just technical housekeeping. Liquid issues L-BTC against Bitcoin held by its federation; when reserves are reduced, the system’s ability to maintain full backing for issued tokens becomes strained. Restoring 3,400 BTC—about 85% of what was withdrawn—therefore meaningfully improves the collateral picture as the network prepares to restart.

Withdrawal originated from a SideSwap peg-out process linked to Elements

While the Sunday withdrawal proceeded through SideSwap’s Peg-out Authorization Key mechanism, both Liquid and SideSwap reportedly said the peg-out key itself was not compromised. Instead, SideSwap attributed the L-BTC involved in the incident to a bug in Elements, the open-source software that underpins Liquid.

Blockstream said it communicated with the actors using signed messages embedded in Bitcoin transactions. The actors claimed to be acting as “white hats” and indicated they would return most of the funds once vulnerabilities were fixed and all nodes installed the patch.

The recovery sequence also highlights how Liquid bridges operational decisions to Bitcoin-side verification. Even when a breach is connected to the Elements codebase, the real-time governance of funds still runs through federation wallet movements and chain-level confirmation—meaning the system’s restart readiness depends on both software deployment and the integrity of bridge operations across federation members.

Liquid remains paused; users told to avoid peg-ins

Liquid has not yet returned to full service. Mow stated that the network stayed paused while additional fixes and security improvements were completed. He also referenced resolution of a chain split and preparations for a “safe restart” coordinated across federation participants.

Crucially for day-to-day users, Mow advised against sending Bitcoin to Liquid peg-in addresses until Blockstream confirms the restart. He framed this as the primary action users should take—or rather, avoid—during the pause, adding that no other user step was otherwise required.

This kind of instruction is significant because peg-in workflows depend on the bridge operating correctly and on the federation continuing to manage the custody and issuance relationship between Bitcoin reserves and L-BTC. Until a confirmed restart, directing funds to peg-in addresses carries the risk of stuck or delayed handling, even if no further compromise occurs.

Dispute over “white-hat” framing after partial return

The partial repayment has not fully ended debate about intent and legitimacy. Ledger chief technology officer Charles Guillemet questioned the “white-hat” label, arguing that if the remaining ~600 BTC represented a reward negotiated via encrypted on-chain communications, the arrangement could resemble extortion rather than conventional vulnerability disclosure.

At the same time, neither Blockstream nor Liquid publicly characterized the outstanding Bitcoin as a bounty, nor were any repayment terms disclosed. Cointelegraph reported outreach to both companies for comments but said it did not receive a response before publication.

That lack of transparency creates uncertainty for observers trying to interpret the actors’ motivations. Even when funds are returned, the unresolved portion can shape how the industry weighs the incident—whether it is treated as an expedited remediation coordinated through responsible disclosure norms, or as leverage applied through disruption.

Readers will likely look for confirmation from Blockstream on the remaining issues holding Liquid in a paused state—especially after software deployment and the claimed resolution of a chain split. The next checkpoints are straightforward: a confirmed restart, continued monitoring of federation reserve movements, and clarity on whether the outstanding ~598 BTC is fully recovered.