I wrote about this heist a few days ago and closed the article thinking that was the end of it. Someone pulls $320 million out of a network, leaves a note calling themselves a whitehat, and disappears.

That's usually where these stories stop. This one didn't stop. The coins started coming back.

Samson Mow confirmed that roughly 3,400 of the 4,000 Bitcoin that left Liquid Network's federation wallet during the exploit have now returned.

Do the percentage yourself: 3,400 divided by 4,000 is exactly 85%. Someone stole nine figures worth of Bitcoin and then, without prompting anyone could point to, sent 85% of it back. I've covered a lot of exploits. I've never watched one reverse itself this far.

A thief who keeps everything is a criminal. A thief who gives back 85% is telling you something else entirely.

600 Coins Short of a Clean Story

Here's the part that keeps this from being a tidy redemption arc. If 3,400 came back out of 4,000, that leaves 600 Bitcoin still unaccounted for.

At the time of the original withdrawal, that gap was worth somewhere in the tens of millions of dollars, real money that didn't make the return trip. 

A full refund would have made the "we are whitehats" note easy to believe outright. An 85% refund makes it something messier, a partial gesture that raises more questions than it answers about what happened to the other 15%.

The Peg-Out Key That Wasn't Actually Broken

The withdrawal ran through SideSwap's Peg-out Authorization Key, and both Liquid and SideSwap have been clear that the key itself wasn't compromised.

The issue traced back to a bug in Elements, the software Liquid runs on, that let 4,000 L-BTC get created and pushed into SideSwap's peg-out service without the federation's control catching it in time. 

That distinction matters for the return story too. If the exploit was a code flaw rather than a stolen credential, closing that flaw is what let the federation negotiate, or simply wait out, the return of most of the funds.

A Chain Split, Paused Blocks, and a Network Still Being Stitched Back Together

While the funds were making their way back, Liquid paused network activity entirely and worked through a chain split alongside the federation members before restarting services.

Picture the sequence in order: exploit, pause, partial return, chain repair, resume. That's not a network shrugging off an incident overnight. That's infrastructure-level surgery happening in public, with 85% of the stolen funds showing up somewhere in the middle of the repair, not at a clean beginning or end.

Why Strategy Skipping Bitcoin the Same Week Isn't a Coincidence Either

In the same news cycle, Strategy skipped its usual Bitcoin purchase entirely, choosing instead to repurchase $176.3 million of STRC preferred stock. I'm not saying one caused the other.

I am saying that when the settlement infrastructure institutions rely on gets compromised, even briefly, the biggest corporate holder in the space pausing its usual rhythm the same week isn't nothing. Confidence in the pipes matters as much as confidence in the asset itself.

I still don't have a clean answer for the missing 15%. Nobody does yet. But watching 85% of a nine-figure heist reverse itself changed how I think about the phrase "we are whitehats" showing up on a blockchain. It's not proof. It's the closest thing to proof this story is ever going to get.

Thanks for reading this one all the way through.

if someone gave back 85% of what they stole from you, would you call the police or send them a thank you note?