The “White hat” social gathering that withdrew practically 4,000 bitcoin from the Liquid Community federation pockets on Sunday returned 3,400 BTC to the pockets on Monday. About 598 BTC, or 15% of the consolidated pile, stayed on the similar holder handle as an implied bounty charge value 48 million {dollars}.
The return transaction (bc49a46d), confirmed at 16:09 UTC on September 7. It returned precisely 3,400 BTC to the labeled Liquid peg script handle and despatched the 598.5 BTC change again to the “White hat” hacker handle as change.
The switch adopted a day of messages written into Bitcoin blocks. The White hats first printed transaction on chain with a message within the OP_RETURN arbitrary information discipline “contact us on chain”; the message got here from the handle holding the 4000 BTC taken from the Liquid Community.
A Blockstream-linked handle answered with “Please contact [email protected]”. Later notes from that sender carried Electrum-encrypted payloads and PGP signatures that may be verified towards Blockstream’s printed safety key.
In block 965869, the White hats requested within the clear textual content whether or not sending “most” again to the federation script was acceptable. The 1,000-sat output on that transaction was solely a message service.
Quickly after, the White hats wrote “Please repair the bug first. The chain is beneath danger at newest commit proper now. Be sure each node is patched. Then we’ll switch the cash again safely after confirming the repair.” adopted by an encrypted blurb of textual content to Blockstream’s PGP key.
In the identical block, a clear-signed reply from the Blockstream sender stated “Sure, thanks.” Hours later, the identical Blockstream posted one other clear-text notice: “Bridge nodes are patched, protected to return the funds”.
Minutes after the 3,400 BTC landed. The white hats despatched again 85% of the funds, holding 15% as an implied finder’s charge. The selection was celebrated by some on X as ‘higher than holding 100%’ whereas others have been a bit shocked on the quantity. Whereas 15% may sound cheap, the whole sum is so massive that it nears $50 million at at present’s costs. Blockstream was clearly not pleased in regards to the finder’s charge, as 4 encrypted messages adopted onchain just a few hours later, possible after the primary fires had been put out on the workplace and the attorneys had an opportunity to have a say within the matter. An hour later, yet another encrypted message was posted from Blockstream.
The White hats replied with two encrypted messages. Blockstream replied as soon as an hour later. Then the White hats printed a easy but significant “ 🙁 ” unhappy face emoji. This emoji does a variety of work. It means that negotiations didn’t go effectively over decreasing the scale of the bounty. Blockstream wizards are clearly ‘huge mad’ in regards to the dimension of that finder’s charge. What precisely was stated in these encrypted messages shouldn’t be recognized and Blockstream has made no public statements on the matter. However we will solely assume the saga shouldn’t be over.
The full chat will be simply adopted on this vibe-coded website (by yours actually). A few different researchers are holding tabs on the dialog and on-chain information, reminiscent of Sjors’s GitHub gist and Alex Thorn from Galaxy Analysis.
Liquid’s Sunday assertion remains to be the community’s final official account put up: purported whitehats withdrew about 4,000 BTC by way of the SideSwap peg-out path, the PAK itself was not compromised, different issued belongings have been unaffected, and the sidechain was paused. Liquid and Blockstream had not posted a brand new assertion on the three,400 BTC return as of this writing. SideSwap had stated the L-BTC within the authentic peg-out “got here from an Parts bug.”
