Liquid Attackers Return 3,400 BTC to Blockstream, Retain 598.49

Liquid Hackers Return 3,400 BTC

The self-described white-hat attackers who drained roughly 4,000 BTC from the Liquid Network's federation wallet over the weekend handed back 3,400 BTC on Monday, retaining 598.49 BTC as talks with Blockstream continue. The group opened negotiations on Sep. 6 via OP_RETURN transactions reading “we are white hat hackers, contact us onchain,” and Blockstream first replied by directing them to its security email before both sides switched to PGP-signed encrypted messages. At 16:09 UTC the coins went back to the federation wallet. What followed on the base chain was far less orderly: hundreds of users began forwarding dust amounts to the hacker's address with their own notes attached, and on-chain data shows the address now carries a running log of replies. The traffic mixes genuine questions with memecoin promoters pushing a “WHITE HAT” token, doubling scams that ask victims to send coins in order to “double” them, and outright begging — one poster demanded exactly 8.5 BTC, another 10. A security incident has become a public spectacle playing out in transaction memos on Bitcoin's own ledger.

£3.3M Recovery After 12 Years

A 12-year-old exchange collapse ended very differently this week: a British investor identified only as Chris has recovered all 61 BTC he lost access to when the early UK platform Intersango went under — holdings now worth roughly £3.3M. He bought the coins in 2011 for £1,500, when bitcoin traded near £2.94, through Britcoin, which later became Intersango. The site went offline in early 2014 and his withdrawal attempts went unanswered while the stash was worth about £4,000. According to CEL Solicitors, the firm that handled the claim, he instructed its lawyers in January 2026 and the case settled on May 28 through negotiation rather than a courtroom ruling. Proving ownership required old bank statements, emails, exchange records and documents prepared for US court proceedings. The firm says more than 5,500 BTC tied to former Intersango users have been traced, though each claimant must establish ownership of specific coins. Chris has since moved the recovered funds to an FCA-regulated platform — the kind of diligence our best crypto exchanges guide walks through step by step. Intersango itself was never FCA-regulated, leaving customers with no formal recourse when withdrawals stopped.

Elements Bug Behind the Drain

On-chain forensics now explain how the theft unfolded. At 14:05 UTC on Sep. 6, 4,000 L-BTC — Liquid's wrapped Bitcoin-style pegged asset — was sent to the peg-out service run by settlement platform SideSwap, where the tokens were burned against a valid peg-out authorization; the federation paid out roughly 4,000 BTC 23 minutes later. SideSwap says the L-BTC in that order was created by a bug in Elements, the open-source software Liquid runs on, and that neither its systems nor its Peg-out Authorization Key were compromised. The federation wallet held about 4,200 BTC beforehand, meaning the withdrawal took roughly 95% of everything pegged into the network. The attackers sent PGP-encrypted vulnerability details with one condition: patch every node. Blockstream confirmed bridge nodes were patched, after which the 3,400 BTC — about $270M, or 85% of the outflow — landed back at the federation address. Ledger CTO Charles Guillemet has rejected the white-hat framing, arguing the retained 598.5 BTC, worth about $47M, looks more like extortion; neither Blockstream nor Liquid has described the remainder as a bounty. Liquid remains frozen while a coordinated restart is prepared, and JAN3 CEO Samson Mow warns users not to peg in until a replay attack risk from the pending chain split is resolved. Assets issued on Liquid, including USDT and tokenized real-world assets, were unaffected.

Liquid Restart in Focus

Our read: in both stories the exposure lived in layers built on top of the base chain, not in its proof of work design. The on-chain record we reviewed shows 3,400 BTC restored to the federation address and 598.49 BTC still sitting under attacker control, making explorer data the load-bearing evidence while Blockstream's coordinated restart remains unconfirmed. As Bitcoin DeFi infrastructure such as Liquid scales, the security boundary widens with it — a lesson the £3.3M Intersango settlement underlines from the custody side. Track further developments in our Bitcoin coverage.