Liquid network’s 4000 BTC were transferred away—about $318 million. The hacker claims to be a “white hat,” saying, “I’ll return most after fixing it”—and that alone is worth pausing to look at.

The gap “most” doesn’t cover seems to be treated as the payout for this “white hat operation.”

Liquid isn’t the mainnet; it’s a Bitcoin sidechain. What’s being moved are Bitcoin tokens/receipts on the sidechain—not newly minted out of thin air. So “return” sounds like giving your own property back to you, while keeping a little as a hardship fee.

What’s interesting is that the hardest part of this kind of operation is never the technical side—it’s trust. On-chain messages only prove that the private-key holder behind an address is willing to talk; they can’t prove he will actually follow through. If any step stalls—patching the vulnerability, routing through multisig, confirming the assets haven’t been laundered—this stops being a security incident and becomes a case of asset recovery.

So don’t rush to treat this as a “white hat.” Right now there’s only testimony, not evidence. The money hasn’t even moved yet, and it’s not over.