Liquid Network has recovered 3,400 BTC following an unusual withdrawal, but around 598.5 BTC is still tied to the incident. L-BTC deposits and withdrawals remain suspended, and the network has yet to provide a timeline for restoring peg services.
In the latest Bitcoin news, the white-hat hackers involved in the withdrawal of nearly 4,000 BTC from Liquid Network have returned 3,400 BTC, valued at about $269.2 million, to the sidechain’s federation wallet. The recovery represents roughly 85% of the Bitcoin involved.
About 598.5 BTC, worth approximately $47 million, remains at an address associated with the incident. Liquid has not disclosed when its peg services will restart or explained how it plans to address the remaining shortfall.
The incident therefore represents more than a completed recovery. While most of the funds have been returned, questions remain over the sidechain’s Bitcoin backing, custody of the remaining assets and the timeline for resuming normal operations.
The remaining 598.5 BTC is held at an address connected to the withdrawal and has not been officially classified as lost. Liquid has not confirmed whether the coins will be returned, how any potential L-BTC backing deficit would be resolved, or when sidechain and peg operations will be restored.
Liquid Bitcoin Hack: Timeline of the Withdrawal and Recovery
The incident began Sunday after a customer transferred 4,000 L-BTC to SideSwap’s peg-out service. The transaction triggered an unusual withdrawal from Liquid’s federation reserves. In response, Liquid took its bridge nodes offline and instructed exchanges to pause L-BTC deposits and withdrawals while it investigated the incident. The move followed a familiar containment approach used in other major crypto exploits, where affected services are temporarily frozen to limit further losses.
The individuals behind the transaction later described themselves as “whitehats” in an on-chain Bitcoin message, warning that the network remained vulnerable until all nodes had been patched. A series of Bitcoin transactions was subsequently used to communicate between the actors and Blockstream, the company responsible for developing Liquid.
The discussions eventually led to Blockstream signing a message confirming that the bridge nodes had been patched and were considered secure.
Following that confirmation, the actors sent 3,400 BTC to the Liquid Federation address. Before the transfer, they had indicated that they intended to return “most” of the Bitcoin but did not explain why they would retain the remaining funds.
The latest Bitcoin news has once again highlighted security risks surrounding crypto infrastructure. Liquid is a Bitcoin sidechain secured through a federation wallet and bridge nodes, both of which were taken offline after the abnormal transaction was detected.
L-BTC deposits and withdrawals remain paused, with Liquid yet to announce when regular services will return. Until then, users cannot freely transfer assets through the peg, underscoring the challenges involved in determining fund balances and restoring operations after a major Bitcoin-related security incident.
Ledger Chief Technology Officer Charles Guillemet also questioned the description of the attackers as white hats following the return of most of the funds. He argued that retaining around 600 BTC does not fit the typical concept of a bug-bounty arrangement and instead appears more similar to extortion.
His comments reflect a wider debate within the crypto industry over how funds controlled by attackers should be characterized after an exploit, particularly when only part of the stolen or withdrawn assets are ultimately recovered.
Liquid has yet to clarify whether the remaining Bitcoin will be returned, how any potential gap in L-BTC reserves will be addressed, or when the sidechain and its peg services will resume.
About The Author
More Stories
Bitcoin’s Rally Could Extend as Volatility Shorts Unwind, Two Prime CEO Says
Bitcoin’s Layer-2 Boom Draws Growing Attention From AI Attackers
Bitcoin Falls to $78,800 as BNB and DeFi Tokens Defy Market Weakness