The hackers behind a major exploit of Blockstream's Liquid Network have returned the bulk of the stolen funds, but roughly $47 million in Bitcoin remains unaccounted for as the company continues to negotiate with the attackers.
The Scope of the Breach
The attack drained roughly 4,000 BTC from the Liquid sidechain, a Bitcoin-based network operated by Blockstream that enables faster transactions and asset issuance. Of that total, the perpetrators have already sent back approximately 3,400 BTC, leaving about 600 BTC still outstanding.
At current market prices, the missing coins represent an estimated $47 million—a substantial sum that keeps the incident firmly in the spotlight even as recovery efforts progress. Blockstream has been in active communication with the actors, treating the situation as an ongoing negotiation rather than a closed case.
Returning most of the money doesn't erase the fact that tens of millions in Bitcoin remain in limbo.
The 'White Hat' Question
The attackers have framed themselves as "white hat" hackers—security researchers who probe systems to expose flaws rather than to steal outright. Under that framing, returning funds and collecting a bounty is presented as the goal, not a heist. Blockstream's willingness to bargain suggests the company is at least entertaining that possibility.
Yet skepticism runs deep within the crypto community. Critics argue that genuine white hats typically disclose vulnerabilities before exploiting them at scale, and that holding back hundreds of Bitcoin undercuts any claim to good faith.
Key points fueling the debate include:
- Roughly 85% of the stolen Bitcoin has been returned
- Around 600 BTC remains in the hands of the attackers
- Blockstream is still negotiating rather than declaring the funds recovered
What Comes Next
The outcome now hinges on whether the remaining balance is returned, whether a bounty is agreed upon, and how Blockstream ultimately characterizes the event. For a network that markets itself on security and scalability, the incident serves as a reminder that even Bitcoin-adjacent infrastructure carries meaningful risk.
Until the final tranche of funds moves—or doesn't—the label of "white hat" will remain contested, and the fate of the $47 million uncertain.