Liquid Network Attacker Returns 3,400 BTC Post-Exploit — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Liquid Network attacker withdrew roughly 4,000 of the 4,200 BTC in Blockstream's federation wallet, a settlement network used by cryptocurrency exchanges, triggering a halt on new transactions
- Blockstream said the bug dated to 2019 and that bridge nodes were patched; the attacker then returned 3,400 BTC (~$270M) but kept 598.5 BTC — leaving a ~$47M hole, per Adam Simecka
- Outlets split on framing: CoinDesk called the actors 'purported white-hat hackers,' while Gizmodo headlined that the hackers 'keep $47 million for themselves' and Bitcoin Magazine noted the retained 598.5 BTC
- Critics on X rejected the white-hat label: Charles Guillemet (@p3b7_) argued the retained 600 BTC 'looks more like extortion than white-hat hacking,' and @financeguy74 flagged that untouched 2010-era addresses moved 600 BTC in tandem with the exploit
- Community backlash targeted Blockstream and Adam Back, with Joel Valenzuela calling it 'the most embarrassing moment in Bitcoin's modern history' and Jeremiah noting the anger stems from Back's self-styled 'expert elder' role in Bitcoin culture
- Cross-coverage consensus: every outlet reports the same headline numbers — ~4,000 BTC taken, 3,400 BTC returned, ~$320M total value — but the dominant 'white-hat' framing downplays how many voices are explicitly contesting that label as extortion
- Decrypt and CryptoSlate added that the exploit may have relied on tokens 'created out of thin air' to move $320M of bitcoin off the sidechain, deepening questions about how the federation wallet was drained
Why it matters: Blockstream faces a roughly $47M shortfall to make whole, and the 'good guy hacker' framing is fracturing under scrutiny — if the retained 600 BTC is read as extortion rather than a negotiated bounty, it undercuts the legitimacy of unaudited bug disclosures on a network exchanges rely on for settlement.
Ask SkimNews
