Liquid recovers 3,400 BTC as hacker returns $47 million in partial restitution
In brief
- Liquid received 3,400 BTC back into federation wallet on September 7 after reserve drain
- Attackers retained approximately 598.5 BTC valued at roughly $47 million
- White-hat hackers sent on-chain message asking if partial return was acceptable
- Blockstream status page still listed active security incident and outage on September 8
Partial recovery, ongoing outage
The self-described white-hat hackers wrote in an on-chain message asking if returning the funds was acceptable. The original federation outflow was approximately 3,996 BTC, meaning the 3,400 BTC recovery left the attackers with roughly 598.5 BTC at press time.
The return followed an on-chain patch message at 09:41:26 UTC on September 7 stating that bridge nodes had been patched and funds were safe to return. Yet by press time on September 8, Blockstream's status page still listed an active Liquid security incident and a major outage affecting public bridge nodes.
L-BTC backing and exchange impact
The partial recovery restores assets behind L-BTC, Liquid's Bitcoin-linked token, though withdrawal access remained unconfirmed. Liquid's redemption process burns L-BTC and releases Bitcoin through the federation, a mechanism now strained by the ongoing outage.
On September 6, Liquid said bridge nodes had been disabled and exchanges had paused or would pause L-BTC deposits and withdrawals. Side_swap paused swaps, peg-ins and peg-outs until Liquid resumed operations. The extended outage suggests Blockstream's remediation work was incomplete even after the recovery.
