The “White hat” celebration that withdrew nearly 4,000 bitcoin from the Liquid Community federation pockets on Sunday returned 3,400 BTC to the pockets on Monday. About 598 BTC, or 15% of the consolidated pile, stayed on the identical holder handle as an implied bounty price value 48 million {dollars}.
The return transaction (bc49a46d), confirmed at 16:09 UTC on September 7. It returned precisely 3,400 BTC to the labeled Liquid peg script address and despatched the 598.5 BTC change again to the “White hat” hacker handle as change.
The switch adopted a day of messages written into Bitcoin blocks. The White hats first revealed transaction on chain with a message within the OP_RETURN arbitrary information area “contact us on chain”; the message got here from the handle holding the 4000 BTC taken from the Liquid Community.
A Blockstream-linked handle answered with “Please contact [email protected]”. Later notes from that sender carried Electrum-encrypted payloads and PGP signatures that may be verified towards Blockstream’s revealed safety key.
In block 965869, the White hats requested within the clear textual content whether or not sending “most” again to the federation script was acceptable. The 1,000-sat output on that transaction was solely a message service.
Quickly after, the White hats wrote “Please repair the bug first. The chain is underneath threat at newest commit proper now. Ensure each node is patched. Then we are going to switch the cash again safely after confirming the repair.” adopted by an encrypted blurb of textual content to Blockstream’s PGP key.
In the identical block, a clear-signed reply from the Blockstream sender mentioned “Sure, thanks.” Hours later, the identical Blockstream posted one other clear-text notice: “Bridge nodes are patched, safe to return the funds”.
Minutes after the 3,400 BTC landed. The white hats despatched again 85% of the funds, conserving 15% as an implied finder’s price. The selection was celebrated by some on X as ‘higher than conserving 100%’ whereas others had been a bit shocked on the quantity. Whereas 15% would possibly sound affordable, the full sum is so massive that it nears $50 million at at the moment’s costs. Blockstream was clearly not completely happy in regards to the finder’s price, as 4 encrypted messages adopted onchain a couple of hours later, seemingly after the primary fires had been put out on the workplace and the legal professionals had an opportunity to have a say within the matter. An hour later, another encrypted message was posted from Blockstream.
The White hats replied with two encrypted messages. Blockstream replied as soon as an hour later. Then the White hats revealed a easy but significant “ 🙁 ” unhappy face emoji. This emoji does lots of work. It means that negotiations didn’t go nicely over lowering the scale of the bounty. Blockstream wizards are clearly ‘huge mad’ in regards to the measurement of that finder’s price. What precisely was mentioned in these encrypted messages is just not identified and Blockstream has made no public statements on the matter. However we will solely assume the saga is just not over.
The full chat may be simply adopted on this vibe-coded website (by yours really). A few different researchers are conserving tabs on the dialog and on-chain information, akin to Sjors’s GitHub gist and Alex Thorn from Galaxy Research.
Liquid’s Sunday assertion remains to be the community’s final official account submit: purported whitehats withdrew about 4,000 BTC via the SideSwap peg-out path, the PAK itself was not compromised, different issued property had been unaffected, and the sidechain was paused. Liquid and Blockstream had not posted a brand new assertion on the three,400 BTC return as of this writing. SideSwap had mentioned the L-BTC within the unique peg-out “got here from an Parts bug.”
