4,000 BTC just moved. OP_RETURN: "We are whitehats..."

[greysonz]

Almost 4,000 BTC just moved from the Liquid Network bridge all at once.
OP Return saying: "we are whitehats. contact us on chain".

TXID:
c103de95817b43f2df635ec6f35ff126ca26a7c6d20570c4b01866b2b3e69a19

[PrivacyG]

Well.  There is at least one thing to note here.  It would be a really good thing to see some positive outcome at least once every year after so many really bad Coldcard-like disasters.

[Ashawowo(OS)]

From my observation, they didn't steal the coins,, almost everything went back to the imput address as change, they were just sending a message across to inform them of their coins being vulnerable and maybe seeking an offer to fix it the bug for them when contacted. They're good guys. It's something positive as PrivacyG noted.

[Ambatman]

Well not a bad route imo
It's better to at least have something
Than move everything and still be unable to make use of them
Like most major hacks
In fear of compromising their identity.
Hopefully this serves a precedence rather than stealing it's better to assist.
Might to be much but it's better to play safe and have a good name.

[FinneysTrueVision]

From my observation, they didn't steal the coins,, almost everything went back to the imput address as change, they were just sending a message across to inform them of their coins being vulnerable and maybe seeking an offer to fix it the bug for them when contacted. They're good guys. It's something positive as PrivacyG noted.

The input address might belong to the hacker. It was funded by an address that received 3,996 BTC from a Liquid peg-out in this transaction https://mempool.space/tx/8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140

It only sent back 1,000 satoshis to the Liquid federation address along with the OP_RETURN message.


Here is more information, posted by the Liquid Network account on X.

https://x.com/Liquid_BTC/status/2096696272447218108

[sergiorus]

From my observation, they didn't steal the coins,, almost everything went back to the imput address as change, they were just sending a message across to inform them of their coins being vulnerable and maybe seeking an offer to fix it the bug for them when contacted. They're good guys. It's something positive as PrivacyG noted.

The input address might belong to the hacker. It received 3,996 BTC from a Liquid peg-out in this transaction https://mempool.space/tx/8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140

It only sent back 1,000 satoshis to the Liquid federation address along with the OP_RETURN message.

Where did the remaining 2.497 BTC go?

From what I see they went to the hacker too but in a separate transaction, please correct me if I'm wrong.

[FinneysTrueVision]

Where did the remaining 2.497 BTC go?

From what I see they went to the hacker too but in a separate transaction, please correct me if I'm wrong.

The 2.497 BTC was already in the hacker’s address. The source of that BTC is currently unknown. Given the close timing of when they received it, it could be related to this same incident. They consolidated it with the 3,996 BTC that was drained from the Liquid Network and sent it back to their own address.

[sergiorus]

Ledger CTO Charles Guilleme on the matter:

"White hats don't drain a bridge and then solicit an "on-chain" contact. This echoes the Ronin hack, where attackers compromised validator keys to steal ~$625M, and the "let's talk" framing is the same move Euler's attacker used to negotiate a return after the fact."



Source: https://x.com/p3b7_/status/2096685528267592008