THE Liquid Network, a Bitcoin sidechain, suffered a major security incident that led to a full suspension of its services. An attacker, presenting as a white-hat researcher, exploited a fundamental flaw in the network’s software and illicitly moved 4,000 Bitcoins from institutional wallets. At the time, this represented about 95% of Liquid Network’s total reserves. The perpetrator, while using a benevolent veneer, pledged to return the stolen funds.
Following a patch by the developers, the situation evolved: Reuters reports suggest around $320 million was withdrawn in the hack, but the attacker has since returned 3,400 Bitcoins. The remaining 598.5 Bitcoins, valued at roughly $47 million, remain with the attacker. It is not publicly confirmed whether this residual sum constitutes an officially negotiated bug bounty, so describing it as a reward would be imprecise.
The attacker appears to have used the large initial transfer as leverage in ongoing negotiations with Liquid Network, raising questions about the line between extortion and ethical hacking. If consensus cannot be reached, authorities could freeze the remaining assets on the blockchain. The incident highlights the unusual and coercive dynamics sometimes seen in high-value crypto bug-bounty disputes and underscores the delicate balance between disclosure, restitution, and enforcement in decentralised ecosystems.