I think it’s still too early to call this either a white-hat rescue or hackers holding $BTC hostage. Around 4,000 BTC, worth roughly $320M, was withdrawn from Liquid’s federation wallet. Reports suggest the federation keys weren’t directly compromised. Instead, the attackers may have exploited a vulnerability in the underlying Elements software to create unbacked L-BTC and redeem it for real BTC. The “white hat” claim is interesting because the actors reportedly left an onchain message identifying themselves as white hats and have indicated they intend to return most of the BTC after the vulnerability is fixed. That said, taking control of $320M is a very aggressive way to expose a vulnerability. A legitimate white-hat operation would normally minimize the amount taken and coordinate with the affected team. So I would reserve judgment for now. If they return the funds after the patch, the white hat argument becomes much stronger. If they start moving, laundering or cashing out the $BTC , then the white hat story becomes very difficult to defend. The bigger point is that Bitcoin itself wasn’t hacked. The apparent vulnerability was at the Liquid/Elements layer built around Bitcoin. This could end up being less about Bitcoin’s security and more about the risks of trusting infrastructure built on top of it. For now, the blockchain movements and what happens to those 4,000 BTC will tell us far more than the label white hat.