Liquid attacker offers to return most of roughly 4,000 BTC after bug fix

Blockstream’s PGP-signed reply came back onchain: “Bridge nodes are patched, safe to return the funds.” The day before, the attacker’s first message had read, “we are whitehats. contact us on chain.” Blockstream’s initial response was brief: “Yes, thank you.”

The underlying failure involved Elements software, according to Blockstream’s assessment as reported by The Block. The bug let L-BTC be created without actual Bitcoin backing. Those L-BTC were then routed through SideSwap’s peg-out service, which caused the Liquid Federation to pay 3,996 BTC to the customer’s Bitcoin address. SideSwap confirmed the transaction involved 4,000 L-BTC sent through its peg-out service using the SideSwap Peg-out Authorization Key.

Decrypt reported the wallet held roughly 4,200 BTC before Sunday and about 200 BTC afterward — a reduction of approximately 95 percent, calculated as (4,200 – 200) ÷ 4,200 × 100. The hackers’ address held about 3,998.5 BTC, per Decrypt. At CoinGecko’s cited BTC price of $79,416, that puts the withdrawal at roughly $317,664,000. The widely cited $320 million figure is a rounded approximation of that same transfer, not a separate amount.

Decrypt also reported that a fix for the Elements bug had been added to Liquid’s underlying software five weeks before the attacker demanded bridge nodes be patched on Sept. 7. Bridge nodes have since been disabled; LBTC deposits and withdrawals at exchanges were suspended.

Not everyone accepted the white-hat framing. Charles Guillemet, Ledger’s chief technology officer, pushed back in comments reported by Decrypt, writing: “Now they steal the money and refuse to give back the funds before the vulnerability is fixed…”

Whether the attacker has actually returned anything remains open. The documented record covers the offer and Blockstream’s safety message. A completed repayment is not confirmed in the materials available.

Bitcoin’s own network is unaffected, Decrypt reported. Exposure stays with Liquid’s bridge activity, the federation wallet, LBTC exchange accounts, and the peg-out counterparties.