White‑Hat Hackers Move $320 Million in Bitcoin from Liquid Exchange

Two weeks after a major security breach at the Liquid cryptocurrency exchange, a series of Bitcoin transactions totaling about $320 million have been traced to a group of self‑identified white‑hat hackers. The movement of funds was confirmed through PGP‑signed messages embedded in the blockchain, indicating direct communication with Blockstream, the company that operates the Liquid sidechain.

PGP‑Signed Messages Reveal Interaction

The hackers attached PGP‑signed text to the Bitcoin transactions, a method that allows verification of the sender’s identity. In the messages, the group claims to be returning the stolen assets and references ongoing discussions with Blockstream about the proper handling of the funds.

Scale of the Withdrawal

Blockchain analysis shows the withdrawn amount is approximately $320 million at current market prices, representing a significant portion of the assets taken during the breach. The transactions were executed in multiple batches, each containing large Bitcoin outputs that were subsequently consolidated.

Implications for Liquid and the Crypto Community

The public nature of the communication suggests an effort to maintain transparency and to reassure users that the stolen Bitcoin is being returned. It also highlights the role of cryptographic signatures in establishing trust during incident response.

Next Steps

Blockstream has indicated it is working with the hackers to verify the legitimacy of the funds and to coordinate their return to affected users. The situation remains fluid, and further updates are expected as the verification process continues.