Summary
- Whitehat hackers returned 3,400 of the 4,000 bitcoin taken from Liquid Network’s federation wallet, while about 598 bitcoin, worth roughly $47 million, remains outstanding.
- Blockstream and federation members are working to strengthen security, resolve a chain split and ensure L-BTC is fully backed before restarting the network.
The ethical hackers behind the recent Sunday Liquid Network exploit have honored their word by giving back the majority of the stolen coins after the platform addressed the underlying flaw.
The anonymous collective has sent back 3,400 out of the 4,000 BTC they extracted over the weekend, leaving approximately 598 BTC valued near $47 million still unreturned, according to statements from Samson Mow of Liquid.
Liquid Network, a Bitcoin sidechain created by Blockstream, suffered an attack on Sunday when perpetrators withdrew 4,000 BTC, valued at $320 million, out of the collective wallet supporting its L-BTC token. The platform functions as a speedier, more confidential transaction tier built above Bitcoin.
It is maintained collectively by prominent Web3 enterprises including mining pools and trading platforms, where every L-BTC must be backed one-to-one by actual bitcoin held securely within a shared vault.
The weekend security breach emptied practically the entire stockpile of roughly 4,200 BTC, leaving a meager 197 BTC inside the federation address. Consequently, L-BTC was left severely underbacked.
Administrators swiftly shut down bridge endpoints, halted operations, and instructed exchanges to halt L-BTC inflows and outflows. Alternative tokens minted on Liquid, such as tether, experienced no disruptions.
Samson Mow, a well-known Bitcoin proponent and former chief strategy officer of Blockstream who has been sharing official status reports regarding the event, stated on Monday that Blockstream remains in communication with the hacking collective.
“Approximately 598 BTC remains outstanding, and Blockstream continues to engage with the white-hat hackers,” he wrote. “The network remains paused while Blockstream and Federation members make additional fixes and security improvements, resolve the chain split, and prepare for a safe restart.”
The group carried out public negotiations by embedding text directly inside Bitcoin blockchain messages. Once Blockstream announced that the compromised bridge connections had been fixed, they transferred 3,400 BTC back to the federation account while retaining the remainder.
This recovery mitigates the immediate backing crisis, although Liquid still has work ahead.
Team members must still wrap up infrastructure safeguards, reconcile a chain split that emerged during the shutdown, and rebuild user trust regarding full L-BTC backing prior to reactivating the system.
“No user action is needed, and please do not send Bitcoin to Liquid peg-in addresses until we confirm the network has restarted,” Mow said.
Originally published at https://www.coindesk.com/markets/2026/09/08/white-hat-hackers-return-most-of-usd320m-bitcoin-taken-from-liquid-network.
