Liquid Network Recovers 3,400 BTC From Whitehat Hackers as Talks Continue

The group believed to be behind Sunday’s Liquid Network exploit has returned 3,400 BTC out of the 4,000 BTC taken from the network. However, roughly 598 BTC, currently worth about $47 million, remains unreturned.

The unidentified hackers appear to have followed through on their pledge to give back most of the funds after Liquid began addressing the security weakness that enabled the breach.

Samson Mow, who has been providing updates on the incident, said approximately 3,400 BTC has now been sent back to Liquid’s federation wallet. Around 598 BTC remains outstanding.

Liquid Network is a Bitcoin sidechain developed by Blockstream that is designed to provide faster and more private settlement. The network was exploited Sunday when attackers removed 4,000 BTC, valued at about $320 million at the time, from the federation wallet responsible for backing its L-BTC token.

Liquid is operated and supported by a federation of major cryptocurrency businesses, including exchanges and mining companies. Under the system, each L-BTC token is intended to be backed on a one-to-one basis by actual bitcoin held in the federation’s shared wallet.

The breach removed nearly all of the wallet’s approximately 4,200 BTC reserve, leaving only about 197 BTC behind. This effectively left the L-BTC supply substantially undercollateralized.

In response, Liquid operators shut down the bridge nodes, paused network activity and instructed cryptocurrency exchanges to suspend L-BTC deposits and withdrawals. Other tokens issued on the Liquid network, including Tether, were not impacted by the incident.

Mow, a well-known Bitcoin advocate and former chief strategy officer at Blockstream, said Monday that discussions with the unidentified group were still taking place.

He said roughly 598 BTC remained outstanding while Blockstream continued engaging with the parties describing themselves as whitehat hackers. The network would remain paused as Blockstream and members of the federation completed further security upgrades, addressed the chain split and prepared for a controlled restart.

The negotiations unfolded publicly through messages embedded in Bitcoin transactions. After Blockstream confirmed that the vulnerable bridge nodes had been patched, the hackers transferred 3,400 BTC back to the federation wallet while retaining the remaining coins.

The recovery significantly reduces the immediate backing shortfall facing Liquid, but the network still has several issues to resolve before normal operations can resume.

Operators must complete additional security measures, resolve the chain split that occurred while the network was paused and establish that L-BTC once again has adequate bitcoin backing before restarting the system.

Mow also warned users not to take any action for now and said they should not send bitcoin to Liquid peg-in addresses until an official confirmation that the network has resumed operations.