TLDR
- Whitehat hackers returned 3,400 of the 4,000 BTC stolen from Liquid Network’s federation pockets on Sunday
- About 598 BTC, rate roughly $47 million, is gentle famed
- The hack drained virtually all of Liquid’s 4,200 BTC reserve, leaving L-BTC removed from fully backed
- Blockstream communicated with hackers by signed messages embedded in Bitcoin transactions
- The community stays paused whereas security fixes, a sequence split, and restart preparations continue
Liquid Network, a Bitcoin sidechain constructed by Blockstream, used to be hit on Sunday when attackers drained about 4,000 Bitcoin from its federation pockets. That pockets backs L-BTC, the community’s native token, on a one-for-one basis.
UPDATE: 🚨 The Liquid Network “white hat” hackers returned 3,400 BTC of 4,000 BTC after speaking on-chain with Blockstream, reputedly conserving 598.5 BTC for themselves, per Galaxy Study’s Alex Thorn. pic.twitter.com/w3GUpOqUrA
— CoinMarketCap (@CoinMarketCap) September 7, 2026
The attack left devoted 197 BTC in the reserve, out of a outdated steadiness of around 4,200 BTC. That left L-BTC without paunchy backing nearly directly.
Operators hurried. They disabled bridge nodes, paused the community, and requested exchanges to freeze L-BTC deposits and withdrawals. Other tokens on Liquid, along side tether, weren’t affected.
The attackers identified themselves as whitehats. They stated they would return the funds as soon as the vulnerability used to be mounted and all nodes had installed the patch.
Blockstream spoke back by embedding signed messages directly into Bitcoin transactions. The 2 aspects negotiated publicly on-chain.
Hackers Return So much of the Bitcoin
After Blockstream confirmed the bridge nodes had been patched, the neighborhood transferred 3,400 Bitcoin aid to the federation pockets. That represents about 85% of what used to be taken.
JAN3 CEO and faded Blockstream government Samson Mow confirmed the return on Monday. He stated roughly 598 BTC stays famed and that Blockstream is gentle in talks with the neighborhood.
At contemporary prices, the returned Bitcoin is rate around $270 million. The 598 BTC gentle held by the hackers is rate approximately $47 million.
The usual withdrawal used to be processed by SideSwap’s Peg-out Authorization Key. Each and each Liquid and SideSwap stated the predominant itself used to be no longer compromised.
SideSwap stated the vulnerability got here from a pc virus in Parts, the launch-offer instrument that underpins Liquid.
Questions Over “Whitehat” Sign
Not all people appears to be like to be glad calling the hackers whitehats. Ledger’s chief technology officer Charles Guillemet raised concerns after only a partial return.
He stated that if the final 600 BTC represented some more or much less negotiated reward, the affiliation seemed more treasure extortion than ethical hacking.
Blockstream has no longer publicly described the famed Bitcoin as a bounty. The firm has no longer disclosed any repayment terms either.
The community stays paused as of Monday. Blockstream and federation persons are gentle working by extra security fixes, resolving a sequence split, and making ready for a coordinated restart.
Mow stated no consumer action is essential at the present. He also warned customers no longer to ship Bitcoin to Liquid peg-in addresses till the community restart is confirmed.
Updated instrument has already been deployed. Federation persons are making ready for a coordinated restart as soon as all stipulations are met.
