The Liquid Network incident has sparked a significant debate over whitehat status, with Immunefi CEO Mitchell Amador stating that attackers lost their claim to whitehat status by retaining 598.5 BTC after returning 3,400 BTC from the approximately 4,000 BTC exploit. According to Amador's analysis, moving user assets without permission cannot be treated as a rescue when the researcher later keeps part of the funds or sets payment terms. "Coordinated disclosure ends the moment you set the terms yourself," Amador told crypto.news, emphasizing that "the money was never yours to save, so moving it is not a rescue." This distinction rests on authorization rather than the researcher's stated motive, with Amador defending the 10% bounty convention when teams approve it in advance.
According to reports from AMBCrypto, Liquid Network has largely returned to normal operations following the $320 million hack that occurred on September 6th. Block production and regular transactions have been running normally since September 10th, giving users a second chance to move LBTC across the network. However, one of the main functions involving converting LBTC back into Bitcoin through peg-outs remains suspended, though other ecosystem services have resumed activity. The recovery has provided users with the opportunity to use exchanges, wallets, and other liquid-related functions, marking significant progress in the network's restoration process.
A technical review of the exploit found that a cache-key collision in the confidential transaction verification logic allowed the actors to create unbacked L-BTC. They then used SideSwap's peg-out service to obtain real Bitcoin from the federation reserve. According to Blockstream, federation keys were not compromised, and the incident instead involved verification logic in the Elements codebase, while the federation nodes were running a release that did not contain the relevant fix. The attackers initially communicated through messages placed in Bitcoin transactions, telling Blockstream to patch the flaw before returning funds. After Blockstream confirmed that affected bridge nodes had been patched, the group sent 3,400 BTC back to the federation wallet.
As reported by AMBCrypto, several liquid ecosystem services have resumed activity by September 17th. Mifiel has resumed issuing and processing its digital promissory notes with normal confirmation batches. Aqua has restored liquid asset transfers and peg-ins, with its new Indra swap feature now allowing users to swap between LBTC and Bitcoin on the Lightning Network, though liquidity remains limited. Wallet providers are also making a comeback, but LBTC-related services requiring peg-outs remain restricted as they involve moving BTC out of Liquid. This step-by-step recovery approach has enabled users to access most liquid ecosystem services while maintaining security protocols.
For a full recovery, Liquid will ultimately need to restore bridge functions, peg-outs, and exchange support so users can move LBTC and BTC normally again. The exploit resulted in 95% of its Federation peg wallet being withdrawn in a single transaction, making complete recovery essential for network stability and user confidence. According to Immunefi's Whitehat Safe Harbor framework, serious protocols should establish rescue conditions before an exploit occurs, with predetermined rules defining which systems researchers may test, how they must disclose vulnerabilities, and what actions they can take during active incidents. This approach would give protocol teams a basis for distinguishing approved intervention from coercion, preventing situations where actors who control user funds can demand payment while the project faces losses.
