‘White hat’ hackers take $47 million bounty after $320 million crypto theft

A public, hours-long negotiation between hackers and a cryptocurrency firm on Sunday ended with the attackers keeping $47 million of a $320 million theft as a “reward” for identifying what they said was a bug in the company’s platform.

The trading platform Liquid Network said on Sunday that “purported white-hat hackers” withdrew 4,000 BTC ($320 million) from its own wallet. Blockstream, which runs Liquid, pledged to reach out to the hackers and said deposits and withdrawals were paused. Liquid supports a coin pegged to the price of bitcoin.

Over the next 12 hours, the company negotiated in public on the blockchain with the hackers, who initially wrote, "we are whitehats, contact us on chain" in a message attached to the transaction bridging the $320 million out of Liquid’s account. 

“Sending most back…is that ok," the hackers said, before demanding Blockstream fix an alleged vulnerability.

"Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix," they added. 

After several public and private messages back and forth, the hacker sent $266.5 million worth of bitcoin back to Liquid on Monday morning and kept 598.5 BTC — worth about $47 million  — as reward. The two sides have continued to go back and forth in public but encrypted messages on the blockchain. 

On Monday morning, Blockstream confirmed the negotiations and said “updated software” was deployed as they ramped up to restart the system.

The incident set off a fierce debate on social media and in blog posts about the source of the vulnerability. Blockstream and Liquid did not respond to requests for comment. 

SideSwap, the service the hacker used to get the stolen funds out of Liquid, published a post-mortem that said Blockstream believes the issue was sourced back to a vulnerability in the Elements software. Several other blockchain security experts also traced the issue back to Elements.

Elements, founded in 2015, allows people to create blockchains extending from bitcoin’s codebase. On its website, the organization said an “example of an Elements based sidechain in production use is Blockstream’s Liquid.”

Backed by several other major cryptocurrency players, Blockstream launched Liquid in 2018 as a way to enable faster bitcoin transactions, claiming to “improve a broken financial system” and “extend Bitcoin's use cases into the realm of new capital markets.”

The $320 million stolen on Sunday would be one of the largest cryptocurrency thefts in 2026 after a pair of April incidents saw alleged North Korean hackers steal $290 million and $280 million respectively from the Kelp and Drift platforms.