The actors behind last Sunday's roughly 4,000-BTC withdrawal from the Liquid Network have returned 3,400 BTC — about $270 million — to the federation's wallet, according to on-chain records and statements from the network's operators. Approximately 598 BTC, worth about $47 million, remains outstanding.
The return transaction is visible on mempool.space, moving exactly 3,400 BTC back to the federation's wallet address. JAN3 CEO and former Blockstream executive Samson Mow said the return followed confirmation from Blockstream that the affected bridge nodes had been patched, and that the company continues to engage with the actors over the remainder.
What Liquid's Incident Report Says
In an incident report published on X, Liquid said discussions between Blockstream and the individuals responsible are "ongoing to secure the return of the remaining funds." The report fills in the mechanics of the exploit: a flaw in Elements, the open-source software underpinning the sidechain, allowed unbacked L-BTC to be created and then accepted as valid.
"Because the validation failure occurred at the transaction level before the peg-out was initiated, both SideSwap's node and the Liquid Network's globally distributed functionary nodes accepted the LBTC as valid," the developers wrote. The network's reserve fell from approximately 4,205 BTC to 197 BTC before operations were halted.
Liquid was explicit about what did not happen: "The Liquid Federation functionaries were not hacked, and no private keys were compromised. The peg-out mechanism that authorizes withdrawals to whitelisted addresses operated as designed."
White Hats — or a Negotiated Settlement?
The actors identified themselves as white-hat security researchers in a message embedded on Bitcoin's blockchain, and the negotiation itself was conducted through signed on-chain messages. But the framing has drawn pushback. Ledger CTO Charles Guillemet questioned the description after the partial return, noting that if the roughly 600 BTC still held by the actors represents a reward negotiated through encrypted on-chain communications, the arrangement looks "more like extortion than white-hat hacking."
Neither Blockstream nor Liquid has publicly described the outstanding Bitcoin as a bounty or disclosed any repayment terms. Both declined to comment when approached by press before publication.
Restart Preparations
Liquid said a patch to bridge nodes was deployed Monday, with an emergency update now under review. Federation members are resolving a chain split and preparing a coordinated restart, which will include rejecting the invalid withdrawal when network state is corrected. Users have been told not to send Bitcoin to Liquid peg-in addresses until the restart is confirmed.
The return restores roughly 85% of the backing removed in the incident. Liquid issues L-BTC against Bitcoin held by its federation, so the outstanding ~15% leaves the peg partially exposed until the remaining funds are recovered — or written off.
TrustGrade tracks incident response and recovery outcomes for chain infrastructure. For verified trust data on the projects and firms shaping it, see trustgrade.ai.