Liquid Network hackers return 3,400 BTC, $47 million still missing

Majority of stolen Bitcoin returned

Self-identified whitehat attackers have returned 3,400 BTC out of nearly 4,000 BTC that were initially stolen from Liquid’s custody wallets. These wallets hold reserves to maintain the 1:1 peg for L-BTC, Liquid’s sidechain asset, with reserves originally holding about 4,200 BTC.

Following the breach, only 197 BTC remained in Liquid’s reserves, creating a shortfall for L-BTC holders. The exploit effectively depleted almost the entire collateral backing the token, raising concerns among users and prompting immediate action from network operators.

In response to the incident, network operators quickly disabled bridge infrastructure, paused activity across the network, and instructed cryptocurrency exchanges to halt L-BTC deposits and withdrawals. Other assets on Liquid, including tether, were not affected by the attack.

The attackers claimed to be acting as ethical hackers and expressed willingness to return the stolen digital assets once the underlying security vulnerability was resolved. Communication between Blockstream and the attackers took place through cryptographically signed messages embedded in Bitcoin blockchain transactions, allowing transparent and verifiable on-chain dialogue between the parties.

After Blockstream confirmed that all relevant security patches had been implemented and network updates were distributed, the attackers returned 3,400 BTC to the federation’s custody wallet. Around 598 BTC, valued at roughly $47 million, has not yet been returned.

Technical origin of the breach

Initial reports indicated that the unauthorized withdrawal was executed using SideSwap’s Peg-out Authorization Key. However, both Liquid and SideSwap representatives clarified the key itself had not been breached. SideSwap attributed the root cause to a flaw in Elements, the open-source codebase on which Liquid is built.

The majority of Liquid’s reserves have now been restored, with only a small but significant amount still missing. The fallout from the incident forced the network into a complete operational halt as technical teams worked to address and patch vulnerabilities.

Samson Mow, CEO of JAN3 and former Blockstream executive, verified the asset return on Monday and stated that discussions with the group responsible for the breach are ongoing, with roughly 598 BTC unaccounted for.

At current market prices, the returned Bitcoin is valued at approximately $270 million while the missing funds represent about $47 million. Debates have emerged within the crypto community regarding whether the attackers should be viewed as ethical hackers, especially as the unreturned Bitcoin may be interpreted as compensation. Blockstream has not described the outstanding funds as a bug bounty nor commented on the terms of any agreements with the group.

Network recovery and next steps

The Liquid Network remains offline as of Monday. Blockstream and federation members are working to finalize additional security measures, handle technical details related to blockchain fork resolution, and coordinate for a secure restart of operations. Updated software has now been distributed to stakeholders, and preparations to restore the network are ongoing.

Samson Mow cautioned users not to interact with the protocol’s peg-in addresses until an official reboot is confirmed. Until then, no further action is recommended for L-BTC holders.

Monitoring such technical events highlights the growing intersection of traditional finance and decentralized systems. While traditional markets still rely on complex broker networks, Wall Street is increasingly adopting Web3 technology. Investors are now using platforms like 1stepSwap to tokenize real-world assets such as shares in large US companies, gold, and silver, holding them directly in their crypto wallets and automatically accessing the best available prices in seconds without intermediaries.