Two weeks after Liquid: the money has not moved, and the channel has new owners

The wallet last spent anything on 9 September at 11:45 UTC. Eleven days later nothing has gone to a mixer, to an exchange, or back to the federation. It keeps receiving — dust and advertising arrive daily, most recently today — but the 598.5 BTC sits exactly where it was left.

What we are not claiming. Several reports quote a figure for how much bitcoin now backs each L-BTC. We could not reconcile circulating L-BTC supply from the public explorer to a number we would defend — the exploit minted L-BTC that never had a peg-in, which breaks the obvious arithmetic — so we publish the reserve we verified and leave the ratio to whoever can show their working.

Liquid signs a block every 60 seconds. It did so without interruption up to block 4,050,335, and then stopped.

A contemporaneous report placed the last block at 04:49 on 7 September; the chain places it eighteen hours earlier. Either way the conclusion is the same, and it is the part still missing from coverage: Liquid has been producing blocks normally since 9 September, and every account still describing it as halted is eleven days out of date.

1,450 confirmed transactions touch the holder’s wallet; 1,439 carry an OP_RETURN. We decoded and classified every one.

The exchange the whole industry was reading is 1.6 percent of the traffic on the address it happened on — and 23 is generous to the negotiation, because it counts anything formatted as a PGP block. We cannot verify the signatures without Blockstream’s key, and at least one memecoin advertisement was wrapped in -----BEGIN PGP MESSAGE----- so it would read, at a glance, as one of them. Writing the other 1,427 transactions cost 0.015376 BTC in fees.

1,116 transactions landed in two days, after both sides had stopped talking. They had nothing to do with the incident:

followed by 1,114 identical mints. The most-watched wallet of the month was used as a launchpad beacon, twice, by an operator who did not change a single parameter between runs.

Fourteen messages advertise ways to wash the money, addressed to a person holding roughly $48 million and to an audience reading over his shoulder. They include a referral code.

One competitor used the same channel to call the others frauds: “Wagyu, TORSwap and exch.lat are all liars & scams. AVOID!” A directory of “trusted mixers” also advertised. This is a market operating in the clear, in a permanent public record, and none of it is hidden behind anything.

On 7 September at 09:41 UTC an unsigned message reached the wallet:

It came from the address above. At 14:05 the same wallet tried again, naming a “clean route” address. Every genuine Blockstream message in the exchange is PGP clear-signed and names the federation peg wallet as the destination; these carry no signature and substitute the sender’s own address.

The comparison is checkable. Blockstream wrote from bc1qn8mgsmxx42j3fflqfkh0cqhdd6mj4h9q2mfqym, opening with “Please contact [email protected]”, and clear-signed both of its substantive messages — “Yes, thank you.” and “Bridge nodes are patched, safe to return the funds.” — with one key, fingerprint 1176 542D A98E 71E1 3372 2EF7 4AC8 CC88 6844 A2D6. A message in this thread that is unsigned, or signed by another key, or that names a return address other than the peg wallet, is not from Blockstream.

On 9 September fourteen addresses broadcast “Double your Bitcoins | 2x whitehats.live” and “whitehats.live/ I’m going to donate all the bitcoins, visit” — to the holder’s wallet and to the federation’s peg wallet. Writing to the peg wallet is the tell: it is aimed at the people watching the incident, not at the parties to it. Two days earlier a second campaign pushed elonmuskevent.live with a collecting address of its own.

We checked all fifteen collecting addresses. Not one has received a single satoshi from a member of the public. The campaigns cost their operators 0.000034 BTC in fees and returned nothing. That is worth saying plainly rather than implying victims who do not exist.

All sixteen addresses are now labelled in the PublicAML risk graph — payout-scam for the doubling campaigns, fake-support for the impersonation — so they carry a flag before anyone does pay them.

Three tokens were pushed into the wallet: $WHITEHATS on BNB Chain at 0x3e77a4BD954faDA9b88936b5AaA6c0519433704B, and two separate pump.fun mints. We queried DexScreener for the BNB contract and for one of the pump.fun mints; neither returns a single indexed trading pair. We are not calling them rug pulls — no liquidity is not the same as money taken from someone. We are noting that the advertising is real and the market is not.

Underneath the noise are the people the halt actually cost. On 9 September at 17:49 UTC, and again twenty-five minutes later in fewer words — “Send my BTC back! 2.4 BTC right here! … This is my life savings!” He was writing to the wrong party; the holder cannot return anyone’s L-BTC. That is the point: he had nowhere else to write.

The second is someone trying to trade their way out: a holder of real L-BTC offering a one-for-one swap to the person who caused the stoppage, because that was the only counterparty still visibly holding bitcoin. That is the cost of a halted sidechain, written by somebody paying it.

The exploit has been explained well by others. What has not been said is what an open negotiation channel becomes once the world is watching it. Within six days of the messages that mattered, the same address was carrying a token launch, three memecoins, two doubling scams, a queue of laundering services with referral codes, an impersonation attempt for 3,900 BTC and an anonymous defamation campaign — while the funds themselves sat untouched and the people who had actually lost access to their money shouted into the same field.

Every address named here is on-chain and checkable. Every figure was read from the Bitcoin and Liquid chains on 20 September 2026 and reconciled against address balances.