Liquid Network has recovered 3,400 BTC from the actors behind Sunday’s near-total drain of its Bitcoin federation reserve, returning about 85% of the funds after a negotiation conducted through Bitcoin transactions.
The 3,400 BTC return was confirmed on September 7 at 16:09 UTC. Roughly 598.5 BTC remained with the self-described white hats, worth about $47.5 million at current Bitcoin prices.
Blockstream Patch Preceded 3,400 BTC Return
The actors had withdrawn almost 4,000 BTC on September 6 after unbacked L-BTC entered SideSwap’s authorized peg-out path, reducing Liquid’s federation reserve from more than 4,200 BTC to roughly 200 BTC.
That initial $320 million withdrawal prompted Liquid to disable bridge nodes and exchanges to suspend L-BTC deposits and withdrawals while Blockstream and Federation members investigated the Elements-related failure.
Negotiations then moved entirely onchain. The actors offered to return “most” of the Bitcoin but demanded that the vulnerability be repaired first, warning that the chain remained exposed until every affected node had received the patch.
Blockstream later transmitted a PGP-signed “safe to return” message confirming that bridge nodes had been patched. The 3,400 BTC repayment followed shortly afterward.
598.5 BTC Remains With Self-Described White Hats
The repayment transaction sent exactly 3,400 BTC back to the Liquid federation address, while approximately 598.5 BTC returned as change to the address controlled by the actors.
That remaining balance represents roughly 15% of the Bitcoin involved in the withdrawal. No publicly disclosed agreement establishes the 598.5 BTC as an approved bounty, making it more accurate to treat the amount as retained funds while negotiations continue.
The structure differs from recoveries where bounty terms were established explicitly. Renegade recovered more than 90% of assets from its Arbitrum exploit after offering the attacker a defined return arrangement that allowed less than 10% to be retained as a whitehat bounty.
The Liquid actors initially identified themselves through an onchain message reading “we are whitehats. contact us on chain,” but the size and legal status of the retained Bitcoin remain unresolved.
Liquid Prepares Coordinated Network Restart
The recovery substantially restores the Bitcoin reserve supporting L-BTC after the withdrawal temporarily removed about 95% of its backing.
Updated software has been deployed, while Liquid Federation members are preparing the network for a coordinated restart and further hardening of the affected infrastructure. Bitcoin itself was never compromised, and Liquid’s other issued assets, including USDT and DePix, were not directly affected.
Liquid’s public bridge nodes remained under the security response on September 8, with 598.5 BTC still held at the withdrawal-linked address as Federation members prepare the sidechain for restart.
