White‑Hat Hackers Recover Most of $320 Million Stolen from Liquid Network, Earn $47 Million Reward

In a rare instance of public negotiation between cybercriminals and a crypto platform, the attackers behind the $320 million theft from the Liquid Network have returned the majority of the stolen assets, securing a $47 million bounty for their cooperation.

The breach, first disclosed in early 2024, saw a coordinated breach of the Liquid Network’s hot wallets, allowing the perpetrators to siphon a large portion of the exchange’s cryptocurrency reserves. The loss, one of the largest in the industry’s short‑history, prompted an immediate investigation by law‑enforcement agencies and a flurry of activity from security researchers seeking to trace the funds.

Rather than pursuing a purely punitive approach, the Liquid Network’s operators opted to engage the hackers directly, offering a substantial reward if the stolen coins were returned. Over a series of public messages on a popular messaging platform, the two sides negotiated terms that culminated in the attackers sending back most of the assets they had taken. The remaining fraction, estimated at a few million dollars, remains unrecovered.

Industry observers note that the $47 million payout—roughly 15 percent of the recovered value—represents an unprecedented bounty for “white‑hat” behavior in the crypto space. While bounty programs are common in software security, they are far less typical in the world of digital assets, where anonymity and jurisdictional challenges often impede direct negotiation.

The episode underscores growing tensions between the need for swift restitution and the desire to deter future attacks. By rewarding the hackers for returning the funds, Liquid Network hopes to signal a pragmatic stance that prioritizes the recovery of assets over retribution, a strategy that may influence how other platforms respond to large‑scale breaches.

Analysts caution, however, that the approach carries risks. Offering financial incentives to malicious actors could be interpreted as legitimizing illicit behavior, potentially encouraging other groups to attempt similar “ransom‑for‑reward” schemes. Regulators are watching closely, and the episode may prompt discussions about formalizing bounty frameworks within the cryptocurrency regulatory environment.

Looking ahead, the Liquid Network plans to bolster its security architecture, including stricter multi‑signature controls and enhanced monitoring of on‑chain activity. The incident also serves as a reminder to investors and users of the inherent volatility and security challenges in the crypto ecosystem, reinforcing the importance of due diligence when entrusting funds to custodial services.