Liquid

Galaxy

Euler

Zcash

Ronin

<h3 id="summary">Summary</h3><ul><li>Purported white-hat hackers offered to return most of the nearly 4,000 Bitcoin withdrawn during the $320 million Liquid Network security incident.</li><li>Blockstream and hackers used Bitcoin OP_RETURN transactions and encrypted PGP messages to negotiate the potential recovery of funds securely on-chain.</li><li>The hackers demanded a network-wide vulnerability fix before repayment, while uncertainty remains over how much Bitcoin they may retain permanently.</li></ul>&nbsp; The purported white-hat hackers behind the $320 million Liquid Network incident have offered to return most of the withdrawn Bitcoin (BTC). <a href="https://x.com/intangiblecoins/status/2096808321332158474" rel="noopener noreferrer nofollow">According to Galaxy Research head Alex Thorn</a>, the unidentified actors communicated their proposal to Blockstream through messages recorded on the Bitcoin blockchain. Nearly 4,000 BTC was removed from the Liquid Federation wallet, representing approximately 95% of the Bitcoin pegged into the sidechain. Liquid subsequently disabled its bridge nodes and paused network operations while Blockstream investigated the vulnerability responsible for the security breach. Meanwhile, the actors consolidated approximately $320 million in stolen assets into a Bitcoin address and identified themselves as white-hat hackers. Their accompanying message instructed Blockstream to contact them on-chain, establishing an unusual communication channel between both parties. Despite that claim, Liquid has carefully described the individuals as “purported” white hats because their intentions remain unverified. Furthermore, the hackers have not disclosed how much Bitcoin they intend to retain when returning “most” of the withdrawn funds. That unclear wording leaves Blockstream without any guarantee that the network will recover the entire amount removed from its federation wallet. Also Read: <a href="https://36crypto.com/bitcoin-holds-79000-as-zcash-leads-mixed-crypto-market-trading/" rel="noopener noreferrer nofollow">Bitcoin Holds $79,000 as Zcash Leads Mixed Crypto Market Trading</a> <h2 id="hackers-demand-network-wide-bug-fix-before-returning-the-withdrawn-bitcoin">Hackers Demand Network-Wide Bug Fix Before Returning the Withdrawn Bitcoin</h2>According to Thorn’s reconstruction, Blockstream initiated contact at Bitcoin block 965,822 through a transaction containing 1,000 satoshis. An attached OP_RETURN message alerted the hackers that Blockstream’s security team was prepared to discuss the incident through encrypted communication. Another transaction contained encrypted information addressed to the holder’s key alongside a Pretty Good Privacy signature associated with Blockstream. Thorn explained that the signature could be verified using Blockstream’s published public key, supporting the authenticity of the encrypted message. The hackers responded at block 965,869 by moving their balance and transferring 1,000 satoshis into the federation’s peg wallet. Within the accompanying message, they asked whether returning most of the <a href="https://36crypto.com/bitcoin-bullish-divergence-supports-83000-reclaim-egrag-crypto-reveals/" rel="noopener noreferrer nofollow">Bitcoin</a> to that wallet would be acceptable. However, they instructed Blockstream to repair the underlying vulnerability across the Liquid Network before receiving the proposed repayment. “Please fix the bug first,” their message read, emphasizing that the security weakness remained their primary condition for returning funds. This demand suggests the actors want confirmation that the vulnerability cannot be exploited again before transferring Bitcoin back to Blockstream. Ledger Chief Technology Officer Charles Guillemet initially questioned whether legitimate security researchers would remove hundreds of millions from a blockchain bridge. He compared the incident with the Ronin and Euler exploits, which involved attackers gaining control over substantial cryptocurrency holdings. Nevertheless, Guillemet reconsidered his assessment once the actors began communicating directly with Blockstream through verifiable on-chain and encrypted messages. He argued that criminal groups rarely establish contact with victims, offering some reason for optimism regarding a potential recovery. Guillemet also suggested powerful artificial intelligence systems may have helped researchers identify the vulnerability without following conventional disclosure procedures. Blockstream must now complete the necessary repairs and confirm that Liquid can resume operations without exposing additional user funds. Almost all the withdrawn Bitcoin remains controlled by the hackers, making their promised repayment central to the network’s recovery prospects. Ultimately, the incident remains unresolved because returning the funds depends entirely on the hackers honoring an agreement carrying no enforceable guarantee. Also Read: <a href="https://36crypto.com/ripple-pushes-rlusd-supply-beyond-2-35-billion-with-large-treasury-mints/" rel="noopener noreferrer nofollow">Ripple Pushes RLUSD Supply Beyond $2.35 Billion With Large Treasury Mints</a> The post <a rel="noopener noreferrer nofollow" href="https://36crypto.com/liquid-hackers-offer-to-return-most-of-4000-btc-once-vulnerability-is-fixed/">Liquid Hackers Offer to Return Most of 4,000 BTC Once Vulnerability Is Fixed</a> appeared first on <a rel="noopener noreferrer nofollow" href="https://36crypto.com">36Crypto</a>.

Liquid Hackers Offer to Return Most of 4,000 BTC Once Vulnerability Is Fixed

Table of Contents

36crypto

Other articles published on Sep 7, 2026

MEXC August Highlights: Users' Total Fee Savings Reach $154 Million and 0-Fee Trading Pairs Expan...

Missed SHIB’s Biggest Moves? Apeing’s $0.0001 Stage 1 Has 48 Hours Left Before a Next 1000x Meme ...

Can Shiba Inu Surge Toward $0.00001 as Apeing Targets 10,000% ROI Potential in the Best Meme Coin...

Citi, DBS test instant U.S.-Singapore payments

Vitalik Buterin Sees Strong Odds For Major Cryptography Breakthrough

Ethereum Price Prediction Eyes Breakout Above $2,520 Resistance

Join our free newsletter for daily crypto updates!