$47M Is Still Sitting at a Mystery Address After Liquid's 'Friendly' Hack
A self-described white-hat party returned 3,400 BTC to Liquid Network's federation wallet Monday — but quietly kept 598.5 BTC, worth roughly $47 million, and nobody is sure when or if it's coming back.
Blockstream confirmed the recovery after patching the vulnerable bridge nodes that allowed the incident to occur. The entire negotiation happened on-chain, meaning the back-and-forth between Blockstream and the unknown party is permanently etched into Bitcoin's transaction history for anyone to read. That's either a masterclass in transparency or a very public hostage situation, depending on how you look at it.
What Actually Happened
Liquid Network is a Bitcoin sidechain operated by Blockstream, designed for fast, confidential BTC settlement between exchanges and institutions. Its security model relies on a federation of functionaries controlling a multi-signature wallet. When vulnerabilities in those bridge nodes were discovered, the unknown party apparently moved funds before Blockstream could act.
The white-hat label is doing a lot of heavy lifting here. Returning 3,400 BTC is a significant gesture of good faith. Holding onto 598.5 BTC as what appears to be a negotiating bounty is something else entirely. No formal bug bounty figure has been publicly disclosed, which raises the obvious question: did Blockstream agree to let them keep $47 million, or is this negotiation still live?
Why This Matters Beyond Liquid
Bitcoin bridges and sidechains have quietly become critical infrastructure as institutional demand for BTC yield and settlement grows. Liquid specifically serves exchanges, trading desks, and market makers who need faster finality than base-layer Bitcoin provides.
An incident of this scale, even one that appears to have resolved without catastrophic loss, puts every federation-based bridge model under scrutiny. The Ronin Bridge lost $625 million. The Wormhole exploit cost $320 million. Liquid's outcome is dramatically better, but the attack surface is clearly real.
Blockstream says the bridge nodes are now patched. What they haven't said is how long the vulnerability existed before it was found, and by whom.
What to Watch
The 598.5 BTC at the holder address is the number to track. If it moves to an exchange, that signals the white hat is cashing out and the story gets complicated fast. If it returns to Liquid's federation wallet, the incident closes cleanly and becomes a rare crypto success story.
Anyone holding BTC inside Liquid or any federation-based sidechain should verify current node status directly with Blockstream and monitor official channels for a full post-mortem. That document, when it arrives, will tell you everything the Monday statement didn't.