On Tuesday 8 September, Charles Guillemet, Ledger’s CTO, draws the line. The 15% kept from Blockstream / Liquid funds: “This is straight extortion.” Not a white hat. Contact the security team, pause, patch, then a bounty. Anything else, he says, is extortion. The episode is not closed.

On Sunday 6 September, around 14:28 UTC, the federation paid about 3,996 BTC to a bitcoin address, 23 minutes after a SideSwap peg-out of 4,000 L-BTC. The vault held ~4,200 BTC. About 197 remained. No private key compromised, say Liquid, Blockstream and SideSwap. The hole is in Elements, the open-source fork. We do not name a commit until Blockstream holds it.

On Monday, 3,400 BTC came back to the federation vault. About 598.5 BTC — 15%, cited around $47 million — stays on the other side. Nothing in the public on-chain messages calls it a bounty. Blockstream has not published an agreement.

What a white hat does, what it does not

If these people were honest, they would have contacted Blockstream and explained the vulnerability to the security team. From there, Blockstream would have decided what was best for Liquid and its users: pause the network, fix the vulnerability, and then pay the researcher(s) a bounty.— Charles Guillemet, Ledger CTO, 8 September 2026

The actors called themselves white hats in the first OP_RETURN. They spoke on-chain, PGP. They asked that every node be patched before the return. Blockstream signed: “Bridge nodes are patched, safe to return the funds.” Then 3,400. Guillemet, same post: incentivising this, “a net negative for the whole ecosystem”. We quote. We do not judge in his place.

The chain is still stopped

Liquid has not resumed. Updated software, says Blockstream. A coordinated restart of federation members. Samson Mow (JAN3, formerly Blockstream): further fixes, a chain split to unwind. Do not send bitcoin to peg-in addresses until the restart is confirmed. L-BTC is not the Layer 1. The 11-of-15 keys did not jump. The peg, if it did.

  • Held: 6 Sept. ~4,000 BTC withdrawn; ~3,400 returned; ~598.5 BTC (15%) still on the other side; no stolen key; Elements; SideSwap = path, PAK not compromised; network paused; Guillemet, 8 Sept.: extortion, bounty after the patch; Mow: split + no peg-in.
  • Not held: that a bounty was signed. That the 598.5 BTC come back. A restart date. That Bitcoin Layer 1 was hacked. Advice to buy or sell.

Sources: Charles Guillemet, The Block, Unchained, Decrypt. Nothing here is investment advice.