Liquid Network attacker says they will return most of 4,000 BTC after bug fix

The attacker who withdrew roughly 4,000 BTC from Liquid Network’s federation wallet over the weekend said they would return most of the funds after confirming a fix for the underlying software vulnerability.

The purported white-hat hacker communicated with Blockstream through Bitcoin OP_RETURN messages and PGP-encrypted text. In a message at block 965,875, the party told Blockstream to “fix the bug first” and ensure every node is patched before transferring the funds back.

Adam Back-led Blockstream subsequently sent a PGP-signed onchain message saying, “Bridge nodes are patched, safe to return the funds.” The signature verifies against the security key published on Blockstream’s website. The roughly 4,000 BTC remained in the attacker’s wallet at the time of publication.

The exchange followed an earlier message from the attacker offering to send most of the bitcoin back to the federation address. Blockstream had first contacted the party through a transaction at block 965,822, asking it to contact the company’s security team.

⭐ Tap here to join our FREE crypto trading discord: https://discord.gg/Heu3h6vPuR

💰 Tap here to start trading crypto with a 10% deposit bonus + 40% lower trading fees with BTCC: https://partner.btcc.com/us/c/2YVO4A