White Hats Return 3,400 BTC to Liquid and Keep 598.5 for Themselves

Most of the bitcoin taken from Blockstream's Liquid sidechain is back in the federation wallet. The party that moved it returned 3,400 BTC on Monday and kept 598.5 coins for itself. Liquid is still paused. Blockstream had told them on chain that the bridge nodes were patched, and the transfer followed. Five accounts of the return went up between Monday afternoon and Tuesday morning; they agree on the coin counts and split on what those coins are worth.

What the two sides sent each other

The exchange ran in OP_RETURN, the field a bitcoin transaction can carry a short message in. Unchained reports the group set a condition before returning anything: fix the bug, and see that every node is patched. Blockstream answered on Monday morning.

"Bridge nodes are patched, safe to return the funds," Blockstream's on-chain message said.

CryptoTimes timestamps that confirmation at 09:19:46 UTC and is the only account to give a time for it at all. Some of the traffic was encrypted and some of it PGP-signed, a way of proving a message came from the key it claims. Whether the coins left behind are an agreed fee is not established anywhere. CertiK Alert called the retention a possible bounty reward, and both CryptoTimes and Unchained say no formal agreement between the parties has been confirmed. coin-turk alone has the group asking first whether returning "most" of the funds would be acceptable, then answering the transfer with a sad-face emoji. That reading sits in one outlet.

The dollar figures do not line up

Everyone counts 3,400 coins returned. Converting them is where the accounts part. CryptoTimes puts the return at about $268 million and Unchained at about $270 million. The retained pile is 598.5 BTC in four of the five accounts; CoinDesk quotes Samson Mow saying approximately 598. Its value is $47 million at CoinDesk, CryptoTimes, Unchained and Bitcoin.com News, and $48 million in coin-turk's headline and body. Those two do not reconcile, and neither outlet acknowledges the other's number. Two accounts describe what was kept as about 15% of what was taken. The original withdrawal was near 4,000 BTC and about $320 million, and the six counts of it published on Sunday did not agree either.

The bug that made the coins

The withdrawal used real machinery on fake inputs. Unchained's account is that a bug in Elements, the open-source software Liquid runs on, created L-BTC that should never have existed, and the federation then paid genuine bitcoin against it. SideSwap, the venue the peg-out ran through, confirmed that neither its systems nor its authorization keys were compromised. Bitcoin.com News goes further than the rest and names a range-proof verification cache as the flaw, a check on the cryptographic proof that hides amounts on the sidechain; that specificity appears nowhere else and stands in one outlet. The same account describes a 2.5 BTC dry run before the main move, also alone. Two accounts have the L-BTC reaching SideSwap's peg-out at 14:05 UTC and the federation paying out 23 minutes later.

Still frozen

Getting the coins back does not restart the chain. Mow, who runs JAN3 and worked at Blockstream before that, said the outstanding coins remain under discussion and that the network stays paused while Blockstream and federation members make further fixes, resolve a chain split created during the pause, and prepare a safe restart. A chain split here means two competing versions of the sidechain's history, which have to be reconciled before blocks count again. Bridge nodes are still off and exchanges are still holding L-BTC deposits and withdrawals. USDT, DePix and the real-world assets issued on Liquid were untouched, and bitcoin's own chain was never involved. Users have been told not to send bitcoin to peg-in addresses until a restart is confirmed. Cronos came back this year after it rolled the Tectonic exploit out of its ledger. The gap between what the federation owes L-BTC holders and what it holds now stands at 598.5 coins. Nobody has said whether that will be paid, written off or pursued, and no restart date exists on the record.