Liquid Hackers Pledge to Return Most of Stolen Funds After Vulnerability Fix

The Liquid Network security incident unfolded on Sunday after approximately 4,000 BTC was withdrawn from its Federation wallet. This accounts for roughly 95% of the Bitcoin that had been pegged into the sidechain.

Liquid subsequently disabled its bridge nodes and paused the network, consolidating $320 million worth of funds into a Bitcoin address alongside a message declaring: 'we are whitehats. contact us on chain.'

The hackers behind this security incident have been communicating with Blockstream through an unusual on-chain conversation using Bitcoin OP_RETURN messages as well as PGP-encrypted text.

Galaxy Research head Alex Thorn reconstructed the exchange, where Blockstream attempted to establish contact at Bitcoin block 965,822 by sending 1,000 satoshis alongside an OP_RETURN message to alert the security team.

The hackers responded in block 965,869 by moving their own balance and directing 1,000 satoshis to the federation's peg wallet. They asked whether sending 'most' of the funds back to the federation address would be acceptable, leaving open the question of how much Bitcoin they intend to retain.

There is no guarantee that they will follow through on this pledge and, for now, almost all of the Bitcoin remains under their control.