Attackers who drained roughly 4,000 bitcoin from the Liquid Network last weekend have returned 3,400 BTC to the federation wallet, leaving about 598.5 BTC, worth around $47 million, still outstanding. Blockstream, the company behind the Bitcoin sidechain, says talks with the individuals responsible are ongoing to recover the remainder.
The bitcoin arrived at a Liquid Federation address at 16:09 UTC on September 7, according to the public blockchain record. That is about 85 percent of what was taken. The remaining 598.5 BTC was not a separate payment. It is the change from the same transaction, sent back to the address the funds had come from, and it has stayed there since. At bitcoin’s price of roughly $78,000 on September 8, the returned funds were worth about $265 million.
How the exploit worked
Liquid is a Bitcoin sidechain that holds real bitcoin in reserve to back a token called L-BTC. On September 6, a bug in the Elements software that powers the network allowed the creation of unbacked L-BTC tokens. Because the validation failure happened at the transaction level before any withdrawal was initiated, both the SideSwap node and Liquid’s distributed functionary nodes accepted the fake tokens as valid. The attackers then exchanged those tokens for reserve bitcoin through SideSwap, a federation member that operates a withdrawal service.
The federation’s reserve fell from about 4,205 BTC to 197 BTC in a single stroke, one of the largest security breaches involving Bitcoin-adjacent infrastructure this year. No private keys were compromised and the SideSwap peg-out authorization key used for the withdrawal was not touched, Blockstream said. A peg-out destroys L-BTC on the sidechain and releases the matching bitcoin on the main chain. The flaw sat in the software that validates transactions, upstream of the 11-of-15 signing federation that normally guards the reserves.
Other assets on the network, including USDT and tokenized real-world assets, were unaffected. Users still cannot transact, because the network remains paused with no public timeline for resuming normal operations. Liquid warned on X that wallets would be disrupted while federation members worked on a fix.
Negotiations on the blockchain
The attackers identified themselves as white-hat security researchers in a message written into a Bitcoin transaction. The note was still visible on the block explorer mempool.space on September 8. In a follow-up on-chain message, the group said it was sending most of the funds back to the federation address and asked whether that was acceptable. They demanded that the flaw be fixed and every node patched before sending anything back. Blockstream confirmed it had patched its bridge nodes on Monday and is preparing an emergency update while the fix undergoes review.
Not everyone accepts the white-hat framing. Charles Guillemet, chief technology officer at Ledger, pointed out that the group still holds 600 BTC. “If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking,” he wrote on X.
Liquid has not said what terms are being discussed or when the remaining bitcoin might come back. Neither Blockstream nor Liquid has publicly confirmed whether the 598.5 BTC is part of any agreement.
What it means for sidechain security
Liquid launched in 2018 to give exchanges faster settlement than the main Bitcoin blockchain, which can slow down and get expensive during congestion. It issues L-BTC against locked bitcoin so trades can clear quickly. Bitfinex and BTSE are among the exchanges that have used the network, and BitMEX was a user before announcing its shutdown this month. A drain of nearly the entire reserve raises questions about the federated sidechain model itself, even though the federation’s own keys were never the problem.
The episode also shows how the dispute played out in public. Rather than demanding payment through private channels, the group negotiated on-chain, leaving messages in transaction records anyone could read. Liquid, for its part, used its incident report on X to keep users updated, confirming the return of funds within a day of the withdrawal.
The incident lands during a run of security failures across the industry this year. Blockstream’s status page still listed an active security incident and a major outage affecting public bridge nodes on September 8.
For holders, the practical situation is simple. L-BTC cannot currently be converted back to bitcoin. The 3,400 BTC returned to the federation restore part of the backing, but withdrawal access stays shut until the network reopens and the remaining reserve question is settled. Whether the last 598.5 BTC returns as goodwill, as part of a bounty agreement, or not at all, the network’s credibility now rests on how that negotiation ends.
discussion