The “White hat” social gathering that withdrew almost 4,000 bitcoin from the Liquid Community federation pockets on Sunday returned 3,400 BTC to the pockets on Monday. About 598 BTC, or 15% of the consolidated pile, stayed on the similar holder tackle as an implied bounty charge price 48 million {dollars}.
The return transaction (bc49a46d), confirmed at 16:09 UTC on September 7. It returned precisely 3,400 BTC to the labeled Liquid peg script tackle and despatched the 598.5 BTC change again to the “White hat” hacker tackle as change.
The switch adopted a day of messages written into Bitcoin blocks. The White hats first revealed transaction on chain with a message within the OP_RETURN arbitrary knowledge discipline “contact us on chain”; the message got here from the tackle holding the 4000 BTC taken from the Liquid Community.
A Blockstream-linked tackle answered with “Please contact [email protected]”. Later notes from that sender carried Electrum-encrypted payloads and PGP signatures that may be verified towards Blockstream’s revealed safety key.
In block 965869, the White hats requested within the clear textual content whether or not sending “most” again to the federation script was acceptable. The 1,000-sat output on that transaction was solely a message provider.
Quickly after, the White hats wrote “Please repair the bug first. The chain is below danger at newest commit proper now. Be sure each node is patched. Then we are going to switch the cash again safely after confirming the repair.” adopted by an encrypted blurb of textual content to Blockstream’s PGP key.
In the identical block, a clear-signed reply from the Blockstream sender stated “Sure, thanks.” Hours later, the identical Blockstream posted one other clear-text observe: “Bridge nodes are patched, protected to return the funds”.
Minutes after the three,400 BTC landed. The white hats despatched again 85% of the funds, maintaining 15% as an implied finder’s charge. The selection was celebrated by some on X as ‘higher than maintaining 100%’ whereas others have been a bit shocked on the quantity. Whereas 15% would possibly sound affordable, the whole sum is so massive that it nears $50 million at in the present day’s costs. Blockstream was clearly not pleased concerning the finder’s charge, as 4 encrypted messages adopted onchain just a few hours later, probably after the principle fires had been put out on the workplace and the legal professionals had an opportunity to have a say within the matter. An hour later, another encrypted message was posted from Blockstream.
The White hats replied with two encrypted messages. Blockstream replied as soon as an hour later. Then the White hats revealed a easy but significant “ 🙁 ” unhappy face emoji. This emoji does numerous work. It means that negotiations didn’t go nicely over lowering the dimensions of the bounty. Blockstream wizards are clearly ‘huge mad’ concerning the measurement of that finder’s charge. What precisely was stated in these encrypted messages shouldn’t be recognized and Blockstream has made no public statements on the matter. However we will solely assume the saga shouldn’t be over.
The total chat may be simply adopted on this vibe-coded website (by yours actually). A few different researchers are maintaining tabs on the dialog and on-chain knowledge, corresponding to Sjors’s GitHub gist and Alex Thorn from Galaxy Analysis.
Liquid’s Sunday assertion continues to be the community’s final official account publish: purported whitehats withdrew about 4,000 BTC by way of the SideSwap peg-out path, the PAK itself was not compromised, different issued property have been unaffected, and the sidechain was paused. Liquid and Blockstream had not posted a brand new assertion on the three,400 BTC return as of this writing. SideSwap had stated the L-BTC within the unique peg-out “got here from an Parts bug.”
