Liquid Network Recovers $269 Million in Bitcoin After 4,000 BTC Withdrawal

Liquid Network has recovered the vast majority of the Bitcoin involved in a major security incident after unknown actors returned 3,400 $BTC to the network’s federation wallet.

The returned coins were worth about $269.2 million at the time of the transfer, representing roughly 85% of the approximately 4,000 $BTC withdrawn from the Liquid sidechain.

However, the incident is not fully resolved. About 598.5 $BTC, valued at roughly $47 million, remains at an address associated with the withdrawal.

The episode started Sunday when a customer sent 4,000 L-$BTC to SideSwap’s peg-out service. The funds were subsequently moved, prompting Liquid to disable its bridge nodes and request that exchanges halt L-$BTC deposits and withdrawals.

The individuals behind the transaction later described themselves as “white hat hackers,” suggesting the withdrawal was intended to expose a security vulnerability rather than permanently steal the funds.

They communicated with Blockstream, the company behind Liquid, through messages embedded in Bitcoin transactions. In one message, the actors warned that the network was at risk and urged developers to patch the vulnerability before they would return the funds.

“Please fix the bug first,” the group wrote, according to the transaction messages. They said they would safely return the Bitcoin once they had confirmed that the affected nodes had been secured.

Blockstream subsequently responded with a signed message confirming that the bridge nodes had been patched and were safe.

Following that confirmation, the actors transferred 3,400 $BTC back to Liquid’s Federation address.

The return, however, has done little to settle questions surrounding the hackers' motives.

Ledger Chief Technology Officer Charles Guillemet questioned whether the group’s actions qualified as ethical hacking, particularly because hundreds of Bitcoin remain under their control.

“So, 3,400 $BTC were refunded,” Guillemet wrote on X. He argued that if the remaining Bitcoin represented a negotiated reward, the situation could look more like extortion than a conventional white-hat disclosure.

The group has not publicly explained why it retained the remaining roughly 600 $BTC. It also remains unclear whether those coins will eventually be returned or whether the hackers expect compensation for identifying the vulnerability.

For Liquid, the outstanding Bitcoin creates an additional problem beyond the security breach itself. The network has yet to explain how it will address the roughly 598.5 $BTC shortfall in L-$BTC backing if the remaining funds are not recovered.

Liquid has also not announced when its peg services and other affected operations will return to normal.

For now, the recovery of 3,400 $BTC represents a significant reversal from the initial loss. But with tens of millions of dollars still unaccounted for, the incident remains unresolved.