Liquid Attacker Returns 3,400 BTC, Keeps 598 BTC

After draining Blockstream’s Liquid federation wallet of nearly 4,000 BTC on Sunday, the attacker broadcast a transaction that returns most of the funds while retaining roughly 15 % for themselves.

Transaction details

The new transaction sends 3,400 BTC (approximately $268 million) to the federation address and 598.49955894 BTC (about $47.2 million) to the attacker’s own address. It includes a fee of 1,768 satoshis (0.77 sat/vByte) and all 16 inputs are marked replace‑by‑fee, allowing it to be superseded while it remains unconfirmed.

Negotiation via on‑chain messages

Blockstream opened a communication channel on the blockchain at 19:31 UTC on Sunday, posting a request to contact [email protected]. Encrypted messages were exchanged early Monday, followed by a clear‑text reply from the attacker at 02:20 UTC asking if returning most of the funds was acceptable. Blockstream responded with a PGP‑signed “Yes, thank you” at 03:30 UTC and later confirmed that bridge nodes were patched and safe for the return.

Root cause

SideSwap, a member of the Liquid Federation, disclosed that the drained funds originated from a bug in the Elements software that created L‑BTC indistinguishable from legitimate tokens. The bug allowed a peg‑out of 4,000 L‑BTC, which was burned on Liquid and resulted in a payout of 3,996 BTC to the attacker’s Bitcoin address.

Current state of the federation wallet

• Confirmed balance: 197.47 BTC
• Potential balance after return: 3,597.47 BTC
• Outstanding L‑BTC: 197.30 BTC (peg‑ins 18,356.93 BTC vs. peg‑outs 18,149.60 BTC and 10.03 BTC burned)

Public reaction

The attacker’s address has become a de‑facto message board, with unrelated advertisements and accusations posted without verification. Blockstream’s communications remain the only PGP‑signed messages, providing a trusted channel for the limited negotiation.

Market impact

Bitcoin was trading around $78,855, down 0.90 % over the previous 24 hours according to CoinGecko.