A self-proclaimed white-hat hacker has returned 3,400 BTC to Liquid Network's federation wallet after Blockstream confirmed that its vulnerability had been patched. However, nearly $47 million in Bitcoin remains in the actor's hands — and no public bounty agreement explains why.

The 598.5 BTC still under the actor's control represents about 15% of the roughly 4,000 BTC withdrawn from the federation wallet on September 6. No public statement from Blockstream or the Liquid Federation has confirmed that the retained Bitcoin was formally offered as a reward.

The return followed a series of on-chain messages exchanged between the hacker and Blockstream. These messages discussed fixing the vulnerability and patching the network's nodes, but they did not publicly specify any ransom or bounty amount.

Liquid Network White Hat Hacker Keeps $47 Million

The decision to keep 598.5 BTC has drawn scrutiny from industry observers. Charles Guillemet, CTO of Ledger, noted on X that the remaining funds were still under the control of the self-proclaimed white hat. He suggested that if the funds were being withheld as leverage in an on-chain cryptographic arrangement, the conduct could resemble blackmail more than conventional white-hat security work.

So, 3,400 BTC were refunded. The "white hats" still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking! Let's see what happens to these 600 BTC… pic.twitter.com/BBKLrMVsqd — Charles Guillemet (@P3b7_) September 7, 2026

Others in the crypto community have also questioned the "white hat" label. They argue that conventional security researchers typically disclose vulnerabilities or coordinate with affected projects before moving large amounts of funds. No formal bug-bounty agreement covering the retained 598.5 BTC has been publicly released by Blockstream or the Liquid Federation.

Bitcoin developer and open-source contributor Miguel Medeiros summed up the drama sarcastically, calling it the "Best telenovela of 2026" and saying, "It was better than Breaking Bad."

CONFIRMED. Block 965950, mined by Foundry. 3,400 BTC back in the Liquid federation wallet. Attacker keeps 598.5 BTC. 27 hours from the fork to the return. 11 rounds of OP_RETURN, PGP signatures, an Electrum tutorial and a accelerator. All settled… pic.twitter.com/7HisqMjqNW — Miguel Medeiros (@_miguelmedeiros) September 7, 2026

Liquid Network Remains Paused After the Bitcoin Hack

Liquid's bridge nodes remain disabled as of September 8, while deposits and withdrawals of L-BTC remain suspended across multiple exchanges. Blockstream said updated software has been deployed and that Federation members are preparing for a coordinated network restart.

The pause underscores the operational design of Liquid itself: it is a Bitcoin sidechain developed by Blockstream and operated by a federation of member entities rather than by miners, meaning security depends on the coordinated actions of those federation members and the hardware they use to sign transactions. That federated structure is why a coordinated restart — rather than an automatic recovery — is required after the network's nodes were taken offline.

Following the recent incident affecting the Liquid Network and the movement of funds, Blockstream, as Liquid's technical provider, and the Liquid Federation have been working diligently to resolve the ongoing situation and ensure the return of assets. Updated software has… — Blockstream (@Blockstream) September 8, 2026

White Hat Hackers Have Kept Bounties Before

Liquid Network's case is not without precedent in the crypto industry. In several high-profile incidents, hackers who returned most of the stolen funds were allowed to keep a portion as a so-called white-hat bounty.

In the 2022 Team Finance exploit, an attacker returned about $13.4 million of the $15.8 million stolen and kept roughly 10%. In the 2023 SafeMoon hack, the attacker agreed to return 80% of nearly $9 million and retain the remaining 20% as a bounty.

Similar arrangements have also occurred in the Nomad bridge hack, where the project explicitly offered a 10% bounty to anyone returning at least 90% of the funds, and in a 2024 address-poisoning case involving roughly $72 million in wrapped Bitcoin, where the attacker agreed to return 90% while keeping 10%. More recently, GMX and Renegade have also used 10% white-hat bounty arrangements.

In those earlier cases, the percentage retained by the attacker was either explicitly offered by the project or openly agreed as part of a settlement, which is precisely what distinguishes them from the Liquid situation, where the terms — if any — remain undisclosed.

Why Liquid Network's 15% White-Hat Cut Matters

Crypto has precedent for white-hat hackers keeping part of recovered funds — but such arrangements are typically negotiated or explicitly offered as bounties. Liquid Network's case stands out because the hacker retained about 15% of the funds, or 598.5 BTC, with no publicly disclosed agreement specifying a bounty.

The case also raises unresolved questions about accountability in federated systems: users of L-BTC and exchanges relying on the network currently have no public accounting of what, if anything, Blockstream or the Federation agreed to in exchange for the return of the 3,400 BTC. Whether the retained funds are ever characterized as a bounty — formally or informally — is likely to shape how future incident responses between projects and self-described white hats are judged.

That leaves the central question: was the retained Bitcoin a negotiated reward — or simply Bitcoin the hacker chose to keep?