Liquid network (Bitcoin sidechain) had nearly 4,000 BTC taken. The attacker claimed to be a “white hat” and promised to fix things and return most of the funds. The plot twist comes a little fast: first it was called an abnormal transfer of funds, then it became a white-hat story. But as of the time of this writing, the BTC market has basically not reacted; the 24-hour decline is less than half a percentage point.

It’s understandable: 4,000 BTC isn’t huge compared with the overall market, and a promised refund sounds like a positive development. But I’m not focused on whether they’ll return it or not. What matters is that the vulnerability still hasn’t been fixed, and the attacker may still negotiate terms with Blockstream via on-chain messages.

The word “most” leaves wiggle room. How much is “most” anyway—what fraction is missing? If the fix is delayed too long, will another “white hat” show up?

What really matters is the wrapped assets on Liquid, especially L-BTC. If it hasn’t lost its peg yet, that doesn’t mean it’s safe going forward. The failure condition is simple: as soon as L-BTC trades at a clear discount relative to BTC, or Liquid pauses withdrawals, this story turns from a white-hat narrative into a sidechain trust crisis.