Liquid Network recovers 3,400 BTC after bridge exploit
Liquid Network has recovered 3,400 BTC worth about $269.2 million from the self-described white-hat hackers behind a 4,000 BTC withdrawal, although nearly $47 million remains outstanding.
- The actors returned 3,400 BTC, recovering about 85% of the withdrawn funds.
- Roughly 598.5 BTC, worth about $47 million, remains in the withdrawal-linked address.
- Blockstream told the actors that its bridge nodes had been patched before the repayment.
- Liquid has not announced when its bridge and L-BTC services will resume normal operations.
Liquid Network has recovered 85% of the withdrawn Bitcoin
On-chain data shows that the actors returned 3,400 BTC, worth about $268.2 million when confirmed, to the Liquid Federation wallet in Bitcoin block 965,950. The transfer recovered about 85% of the withdrawn funds, while 598.5 BTC worth roughly $47 million remained in the actors’ address. Blockstream had previously told the group through a signed transaction message that its bridge nodes were patched and the funds were “safe to return.”
Around 598.5 BTC, valued at roughly $47 million, remained in the withdrawal-linked address after the larger transfer. The actors have not publicly explained why they retained the remaining coins or stated whether another repayment will follow.
Sunday’s incident began when a customer sent 4,000 Liquid Bitcoin, or L-BTC, to SideSwap’s peg-out service. SideSwap allows users to move value from the Liquid sidechain back to the Bitcoin network through an authorized withdrawal process.
The actors later identified themselves as “whitehats” in a message attached to a Bitcoin transaction. White-hat hackers generally find and report security weaknesses so developers can repair them, often receiving a bounty under terms agreed with the affected project.
No publicly disclosed agreement has established that the Liquid actors had permission to withdraw the funds, however. Blockstream and the actors also have not published terms granting a bounty or allowing the group to retain nearly 600 BTC.
As crypto.news reported before the return, the actors had offered to send back “most” of the Bitcoin once Blockstream fixed the vulnerability. At that point, no repayment had been confirmed, and the withdrawal represented about 95% of the Bitcoin reportedly held in Liquid’s federation wallet.
On-chain messages led to the 3,400 BTC repayment
Communication between Blockstream and the actors took place through messages attached to Bitcoin transactions, allowing both sides to exchange instructions without relying on a private messaging service.
In one transaction message, the actors told Blockstream to repair the flaw before they returned the Bitcoin.
“Please fix the bug first,” the message said. “The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
Following that confirmation, the actors sent 3,400 BTC to the Liquid Federation address. The exchange shows that the repayment depended on the actors accepting Blockstream’s statement that the affected nodes were safe, though neither side has released a technical report identifying the flaw or explaining how the withdrawal became possible.
Liquid disabled its bridge nodes after detecting the transaction and asked exchanges to suspend L-BTC deposits and withdrawals. The shutdown restricted movement between Liquid and the Bitcoin base layer while developers investigated the incident and applied the patch.
Blockstream has said the key used during the withdrawal was not compromised, according to Reuters. The company has not released a complete post-mortem detailing whether the flaw affected SideSwap, the bridge software, Liquid’s Elements codebase, or another part of the peg-out process.
Ledger CTO questions the white-hat description
Ledger Chief Technology Officer Charles Guillemet challenged the actors’ description of themselves after they returned most of the coins but retained nearly 600 BTC.
“So, 3,400 BTC were refunded,” Guillemet wrote on X. “The ‘white hats’ still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!”
His comment focused on the lack of disclosed terms covering the retained Bitcoin. A conventional bug bounty normally sets the reward and return conditions before a researcher keeps part of the affected funds, while no comparable agreement between Blockstream and the actors has been made public.
A similar issue emerged after the Verus Ethereum bridge exploit in May. In that case, the attacker returned 75% of the stolen funds and kept 1,350 ETH, then worth about $2.8 million, after Verus publicly offered settlement terms. The Liquid repayment differs because Blockstream has not said that the remaining 598.5 BTC constitutes an approved bounty.
White-hat claims also do not determine an actor’s legal status by themselves. Any legal assessment would depend on factors such as authorization, the method used to obtain the assets, communications between the parties, and applicable laws. No U.S. regulator or law enforcement agency has announced an action tied to the Liquid withdrawal.
L-BTC holders await details on backing and withdrawals
Liquid is a federated Bitcoin sidechain developed by Blockstream. Users lock BTC through its peg system and receive L-BTC on the sidechain at a one-to-one ratio, allowing faster settlement and asset transfers without moving every transaction across the Bitcoin base layer.
A recent bridge security explainer described how systems that lock assets on one network and issue corresponding tokens elsewhere depend on the security of their custody, validation, and message-processing systems. Failures at any of those points can interrupt redemptions even when the underlying blockchain continues operating normally.
For U.S.-based users, the immediate issue is operational rather than a change to federal crypto rules. American holders who use L-BTC face the same suspended deposits, withdrawals, and peg services as other users, while native BTC held directly on the Bitcoin blockchain is separate from Liquid’s sidechain system.
Liquid has not disclosed whether the returned 3,400 BTC has fully restored backing for the corresponding L-BTC supply. The network also has not said how it plans to handle any gap created by the 598.5 BTC still controlled by the actors.
No reopening time has been given for the bridge nodes, and exchanges were still being asked to keep L-BTC deposits and withdrawals suspended. Blockstream has also not published the promised technical account of the flaw or confirmed whether the actors intend to return the remaining Bitcoin.
