A hacker walked off with about $340 million in bitcoin. Then they started handing it back.
That is the short version of one of the biggest crypto heists of the year. The target was Liquid Network, a system tied to several cryptocurrency exchanges. The theft ranks among the largest known digital funds thefts to date. And yet most of the money is already returning to where it came from.
Here is why. The person behind it was a “white hat” hacker. That is the whole twist. Let’s break down what happened, who was involved, and what you should take away from it.
What Actually Happened
A hacker exploited a bug and drained a network wallet holding roughly 4,000 bitcoins. At the time, that stash was worth about $340 million.
The team behind the network confirmed the theft in an X post on Sunday. They said the funds were pulled from the network’s wallet, and they paused operations right away.
Think of it like a bank noticing a break-in overnight. The first move is not to keep the doors open. The first move is to lock everything down and figure out how the intruder got in. That is exactly what happened here.
The identity of the hacker is still unknown. Crypto media reports point to a bug exploit as the way the funds left the wallet. In plain terms, the hacker found a flaw in the code and used it to withdraw money that was not theirs.
The takeaway for you: a single flaw in the code was enough to move $340 million. Never assume “big and established” means “fully safe.”
Who Is Liquid Network, and Who Is Blockstream
You need two names to follow this story: Liquid Network and Blockstream.
Liquid Network is a settlement system used by several cryptocurrency exchanges. A settlement network is the layer that helps move and finalize transactions between parties. It launched in 2018. You can picture it as the plumbing that sits behind the scenes, carrying money between exchanges quickly.
Blockstream is the crypto firm that built and launched Liquid Network back in 2018. So when the bitcoin theft hit Liquid Network, Blockstream was the company on the hook to respond and fix it.
You do not need to understand how blockchain settlement works to grasp the risk here, in the same way you do not need to understand how a highway is engineered to know a collapsed bridge stops traffic. When the settlement layer breaks, everything built on top of it stops moving.
That is why the paused operations matter so much. This was not one wallet on one phone. It was infrastructure that other exchanges rely on.
The takeaway for you: the more a system connects, the more a single failure spreads. Know what your funds sit on top of, not just where they sit.
What “White Hat” Means
Here is the part that makes this crypto heist unusual. The hacker was described as a “white hat.”
A white hat hacker is someone who breaks into a system to expose a weakness, not to keep the loot. They find the hole, prove it works, and then push the company to fix it. The goal is to force a repair, not to run off with the cash.
Compare the two:
- A regular thief steals the money and disappears.
- A white hat steals the money to prove the flaw is real, then returns it once the flaw is patched.
In this case, the hacker made a deal. They said they would give the funds back if Blockstream fixed the bug. So the stolen bitcoins became a kind of bargaining chip. Hand over a working fix, and the money comes home.
This is common in security work, though rarely at this scale. Companies even pay “bug bounties” to people who report flaws responsibly. A $340 million demonstration is an extreme version of the same idea.
The takeaway for you: not every hacker wants your money gone forever. But do not count on that. The safe assumption is always that a thief keeps the cash.
The Return: 3,400 Bitcoins Back, 600 Still Out
The money did start coming back, and quickly.
Samson Mow, a former Blockstream executive, shared updates in an X post on Monday. He said the company had fixed the bug. Once that happened, the hacker began returning the funds as promised.
Here are the numbers, kept simple:
- About 4,000 bitcoins were stolen in total.
- Around 3,400 of those bitcoins were returned.
- About 600 bitcoins were still under the hacker’s control.
That remaining 600 bitcoins was worth roughly $47 million. So even with most of the money back, a large sum stayed out of reach.
Mow also said operations would stay paused. The plan was to make additional fixes and security improvements before restarting anything. That is the responsible move. Restarting too early would just invite the next attack.
The takeaway for you: “most of it back” is not “all of it back.” Roughly $47 million was still missing even after the return. Watch the final number, not the early headline.
Why This Ranks Among the Biggest Crypto Thefts
This was not a small incident. According to the Rekt leaderboard, the theft ranks as one of the largest heists of digital funds to date.
The Rekt leaderboard is a public tracker that lists major cryptocurrency thefts by size. Think of it as a scoreboard nobody wants to be on. When a hack lands near the top of that list, it signals the scale was extreme.
A $340 million bitcoin theft earns that spot easily. Even after the white hat hacker returned about 3,400 bitcoins, the size of the original exploit is what puts it in the record books. The leaderboard tracks what was taken, not what came back.
The takeaway for you: size and outcome are two different things. A heist can rank huge on the Rekt leaderboard even if most funds return. Judge the risk by what was possible, not just what was recovered.
What This Says About Crypto Security
Step back and one lesson stands out. The problem here was not a weak password or a careless user. It was a bug in the code of a serious, established network.
That matters because it flips a common assumption. Many people believe big platforms are automatically safe. This crypto heist shows the opposite can be true. A single flaw in a crypto exchange settlement network moved hundreds of millions of dollars.
Here is what you can actually do with that knowledge:
- Spread your risk. Do not keep everything in one wallet or on one platform.
- Move long-term holdings off exchanges. Use a personal wallet you control for funds you are not actively trading.
- Follow official channels. In this case, the real updates came from an X post by people close to the company, not from rumor threads.
- Wait out the “paused operations” period. If a network halts after a hack, do not rush back in the moment it reopens.
None of this requires technical skill. You do not need to read code to protect yourself, in the same way you do not need to be a mechanic to keep your car doors locked. You just need a few consistent habits.
The takeaway for you: pick one habit from that list and act on it this week. Moving long-term holdings off an exchange is the strongest single move.
Final Thoughts
The Liquid Network crypto heist is a rare story with two faces. On one side, a hacker exploited a bug and drained about 4,000 bitcoins, worth roughly $340 million, from the network’s wallet. On the other, a white hat hacker returned around 3,400 of those bitcoins once Blockstream fixed the flaw, leaving about 600 bitcoins, or $47 million, still out.
The mixed ending should not soften the warning. This was a bitcoin theft large enough to rank among the biggest on the Rekt leaderboard. Blockstream paused operations and promised security improvements before restarting, which is the right call. But the fact that a single bug exploit reached that scale is the real headline.
This is not a guarantee that the rest of the funds come back. White hat behavior is a choice, not a rule, and the safe assumption is always that stolen money stays gone.
Here is your one action: check where your own crypto sits right now. If long-term holdings are parked on an exchange you do not need daily, move them to a wallet you control. Do it today, while the lesson is fresh.
Be First to Comment