Liquid Network reels after hackers exploit a critical Elements bug to seize nearly 4,000 bitcoin. While 3,400 bitcoin have been returned, the fate of the remaining $47 million in BTC is unresolved, fueling debate over the hackers' motives and the network's security.
Nearly $47 million in bitcoin remains in limbo after the Liquid Network's reserves were gutted by a sophisticated exploit, with hackers returning the bulk of the stolen funds but holding onto a significant share. The drama has left the sidechain's users locked out and the industry questioning whether the so-called white hats are heroes or opportunists.
Il cuore della vicenda: bug, furto e restituzione parziale
On September 6, attackers exploited a flaw in the Elements software powering Liquid, draining almost 4,000 bitcoin-about 95% of the network's reserves. The next day, 3,400 bitcoin were sent back to the Liquid Federation's address, a move that Blockstream, the technology provider behind Liquid, confirmed. Yet, 598.5 bitcoin-worth roughly $47 million at the time-remained at the original address, unreturned and unexplained.
La vulnerabilità e il ruolo degli operatori
The breach was traced to a bug in Elements, not a compromised key or system at SideSwap, whose Peg-out Authorization Key was used in the withdrawal. The exploit allowed the creation of L-BTC tokens that could be redeemed for real bitcoin, bypassing the intended controls. Blockstream's incident notice was notably vague on technical details, fueling speculation and frustration among users and security experts.
Comunicazione pubblica e trattative sulla blockchain
Negotiations unfolded in real time on the Bitcoin blockchain. The attackers, identifying themselves as white hats, embedded a message: "we are whitehats. contact us on chain." Their demand was clear-fix the flaw and patch every node before any funds would be returned. Blockstream responded with a signed message confirming that bridge nodes were patched and the network was safe for restitution. The 3,400 bitcoin transfer followed, but the remaining funds stayed put, with no public agreement disclosed.
Impatto operativo e reazioni del settore
Liquid Network remains paused, freezing users' ability to convert L-BTC back to bitcoin. Blockstream's status page still lists the incident as active, with public bridge nodes down and no update on the current bitcoin reserves. Samson Mow, CEO of JAN3 and former Blockstream executive, confirmed ongoing contact with the hackers and warned users not to send bitcoin to Liquid's peg-in addresses until a coordinated restart is announced. Other assets on Liquid, such as USDT and DePix, were reportedly unaffected.
White hat o estorsione? Il dibattito sulla legittimità
The hackers' self-styled white hat status is far from universally accepted. Charles Guillemet, CTO at Ledger, dismissed the label, arguing that if the nearly 600 bitcoin retained are a negotiated "reward," the situation resembles extortion more than altruism. The lack of transparency around the remaining funds only intensifies skepticism.
Precedenti e prospettive per la sicurezza blockchain
This episode echoes a pattern seen in other high-profile blockchain breaches, where attackers exploit technical flaws and then negotiate restitution-sometimes under the guise of responsible disclosure. As reported earlier, similar vulnerabilities have led to major losses and urgent calls for patching across the crypto ecosystem.
Liquid's ordeal exposes the fragility of trust in federated sidechains and the limits of "white hat" narratives when millions remain unaccounted for. The return of most funds is no badge of honor when the attackers still hold a fortune and dictate terms from the shadows. Until Blockstream and the Liquid Federation deliver full transparency and technical accountability, the episode stands as a warning: in the world of decentralized finance, security lapses are rarely cleanly resolved, and the line between ethical hacking and ransom is as thin as a blockchain transaction fee.
