Image Credit: Shutterstock
The self-described white-hat actors behind Liquid Network’s $320 million Bitcoin withdrawal have returned 3,400 BTC worth about $270 million to the network’s federation wallet. The repayment restores about 85% of the Bitcoin involved, while roughly 598.5 BTC worth $47 million remains at the address holding the unrecovered funds.
3,400 BTC Returns After Bridge Nodes Are Patched
An address associated with the self-described white-hat actors transferred exactly 3,400 BTC back on Sept. 7 in a transaction confirmed in Bitcoin block 965,950. The transaction sent the remaining 598.49955894 BTC back to the address holding the funds, excluding the transaction fee.
The repayment followed a series of messages exchanged with Blockstream through Bitcoin transactions. Blockstream told the actors in a signed message, “Bridge nodes are patched, safe to return the funds,” after they had requested that affected nodes be fixed before returning most of the Bitcoin.
Nearly 600 BTC Remains Outstanding
The actors have not publicly explained why they retained nearly 600 BTC, and no public message establishes that the amount represents an agreed security bounty. Their claim to be white-hat hackers also remains self-described rather than independently established.
The remaining balance was worth about $47 million after the larger return. Liquid has not publicly confirmed whether the remaining coins will be returned or how it will address any temporary mismatch between circulating L-BTC and Bitcoin held by the federation.
Incident Began With 4,000 L-BTC Peg-Out
The incident started on Sept. 6 when a customer sent 4,000 L-BTC to SideSwap’s peg-out service. SideSwap said it processed the request normally, burned the L-BTC with valid authorization and triggered a federation payment of approximately 3,996 BTC to the customer’s Bitcoin address.
SideSwap said its systems and Peg-out Authorization Key were not compromised. It said Blockstream later traced the affected L-BTC to a bug in Elements, the open-source software underlying Liquid. Liquid Bitcoin is normally designed to maintain 1:1 backing with Bitcoin held by the federation.
Liquid Remains Paused Ahead of Restart
Liquid disabled its bridge nodes after the withdrawal and asked exchanges to suspend L-BTC deposits and withdrawals. The latest public updates indicate the network remains paused while Blockstream and federation members complete additional security work and prepare for a coordinated restart.
The security incident did not affect the Bitcoin base network, which operates independently of the Liquid sidechain. Liquid users were also advised not to send Bitcoin to Liquid peg-in addresses until the network confirms that normal operations have resumed.
