Liquid Network Recovers 3,400 BTC From White-Hat Hackers; $47M Still Outstanding

White-hat hackers have returned 3,400 of the 4,000 bitcoin stolen from Liquid Network’s federation wallet, leaving approximately 598 BTC worth roughly $47 million still outstanding. The partial recovery eases the immediate collateral crisis for the Bitcoin sidechain, but the network remains paused as Blockstream and federation members work to resolve a chain split and ensure L-BTC is fully backed before restarting operations.

Market Context

The incident occurred on Sunday when attackers withdrew 4,000 BTC, valued at approximately $320 million, from the federation wallet that backs Liquid’s token, L-BTC. This drain left only 197 BTC in the shared wallet against a reserve stash of around 4,200 BTC, meaning L-BTC was suddenly far from fully backed. Liquid Network, a faster and more private settlement layer built on Bitcoin by Blockstream, is supported by a group of major crypto companies including exchanges and miners.

Analysis

Samson Mow, a prominent Bitcoin advocate and former chief strategy officer at Blockstream, reported that the hackers identified themselves as white-hats and negotiated in public by writing messages into Bitcoin transactions. After Blockstream confirmed that affected bridge nodes had been patched, the hackers returned the 3,400 BTC but retained the remainder. Blockstream continues to engage with the group regarding the outstanding balance. Operators immediately disabled bridge nodes and paused the network to prevent further exposure, freezing L-BTC deposits and withdrawals. Other assets issued on Liquid, including tether, were not affected by the breach.

Key Numbers

- 4,000 BTC (approx. $320 million) initially stolen from the federation wallet on Sunday.

- 3,400 BTC returned by white-hat hackers following bridge node patches.

- 598 BTC (approx. $47 million) remains outstanding.

- 197 BTC remained in the federation wallet immediately after the initial drain.

- L-BTC reserve was designed to match bitcoin locked in the shared wallet one-for-one.

What to Watch

Traders and users should monitor for confirmation that Blockstream and federation members have completed additional security fixes and resolved the chain split created during the pause. Mow emphasized that no user action is needed and warned against sending Bitcoin to Liquid peg-in addresses until the network restart is confirmed. The resumption of the network hinges on restoring confidence that L-BTC is fully backed.