Key Takeaways
- Liquid Network got hit for nearly 4,000 BTC, but the white hats sent 3,400 BTC back on Monday.
- Bitcoin’s blockchain got pretty noisy after the Sept. 6 exploit, with dust messages, meme coin shills and scams piling in.
- Blockstream is still talking with the hackers, while 598.49 BTC remains in the hacker’s hands.
Hackers Tell Blockstream to ‘Contact Us’ Onchain
It all started this weekend on Sept. 6, when purported white hack hackers drained reserves from the Liquid Network’s L-BTC reserves. They came with a message “we are whitehats. contact us on chain” sent in an OP_RETURN transaction. The Bitcoin blockchain allows users to attach a public note to a payment, and during the discussion, both sides have sent each other almost-worthless amounts of bitcoin with short messages to each other.
Blockstream initially replied by saying “Please contact [email protected],” and sent another message with encrypted text that had a detached PGP signature from [email protected], and this message cannot be read. The self-described white hats then replied back:
“sending most back to bc1qd…., is that ok”
3,400 BTC Returned While 598.49 BTC Remains With White Hats
It is assumed that the white hats privately provided additional details about the vulnerability. A series of encrypted, PGP-signed messages followed between the two sides. At 16:09 UTC, the group returned 3,400 BTC to the federation wallet while retaining 598.49 BTC. It’s pretty difficult to follow the onchain discussion using a blockchain explorer like mempool.space, as a large swarm of BTC users are sending dust to the wallet with their own unique messages.
Meme Coin Scammers, Pleas and Other Scams Flood the Onchain Conversation
Some messengers shilled their meme coins dubbed “WHITE HAT” in onchain messages sharing Pump.fun URL links and Solana addresses. Others begged for money and said they needed funds because they were out of work or for an alleged sick family member. Others described ways to launder the BTC through mixing services and using the privacy-centric Monero blockchain. Some messages used scam tactics like shady doubler-schemes and told people to send BTC in order to “double their coin.”
Doubler-schemes are always are always fraudlent. “Please gift 8.5 BTC,” one user begged. “No more. No less,” the individual’s OP_RETURN message said. “I wish for 0.1 BTC for my crypto journey,” another messenger asked the white hats. “Right now, 10 BTC is pennies to you,” another said, insisting that 10 BTC would be “everything” to them. The amount of BTC dust used to send countless messages to the white hats is pretty incredible, and a great majority of them were meme coin shills.
Nearly 600 BTC Still Held as Liquid Network Remains Frozen
It is still unknown why the so-called white hats have kept nearly 600 BTC, and on social media, many are saying that this undermines any genuine “white hat” justification. At the same time, the ensuing onchain noise from dust messages is still filling up with meme coin shillers, desperate pleas, and ongoing scam pitches. At the time of writing at 10:30 a.m., the Liquid Network is still frozen, and the conversation between the L2 operator Blockstream and the hackers continues.
