Liquid Attackers Return 3,400 BTC, 600 BTC Still Missing

ChainCatcher report: The attacker, identifying as a "white-hat hacker," returned approximately 3,400 BTC (around $269.2 million) to the federation wallet of the Liquid Network on Monday, following the extraction of about 4,000 BTC. This represents the recovery of roughly 85% of the funds. The incident began on Sunday when a customer sent 4,000 L-BTC to SideSwap’s peg-out service. The attacker, via a Bitcoin transaction message, identified themselves as a "white-hat hacker" and demanded the vulnerability be patched first. Blockstream subsequently sent a signed message stating, "The bridge node has been patched; funds can be safely returned," after which the attacker transferred the funds. Nevertheless, approximately 598.5 BTC (around $47 million) remains in the associated address. Ledger’s Chief Technology Officer, Charles Guillemet, expressed skepticism about the "white-hat" claim, suggesting that if this were a negotiated reward under an on-chain smart contract, it more closely resembled extortion. Liquid has disabled the bridge node and requested exchanges to suspend L-BTC deposits and withdrawals, but has not yet disclosed a plan for handling the remaining funds or a timeline for restoring normal operations.