Approximately 598.5 BTC, worth roughly $47 million, remains in an address linked to the withdrawal, and Liquid has not said when its peg services will resume or how the shortfall will be handled.
This is not simply a recovered exploit. It is a partial resolution that leaves a sidechain’s backing, custody status, and operational timeline all unresolved at once.
The remaining 598.5 BTC sits in an address tied to the incident rather than a wallet confirmed lost. Liquid has not announced whether that Bitcoin will be returned, how it will cover any resulting gap in L-BTC backing, or when normal side-chain and peg operations will resume.
Liquid Bitcoin Hack: How the Withdrawal and Return Unfolded
The incident began Sunday when a customer sent 4,000 L-BTC to SideSwap’s peg-out service, triggering the abnormal withdrawal from the federation reserve. Liquid responded by disabling its bridge nodes and asking exchanges to suspend L-BTC deposits and withdrawals while it assessed the damage, a containment step similar to the halted-service response seen in other recent exploit cases where networks froze operations mid-incident.
The actors identified themselves as “whitehats” in an on-chain Bitcoin transaction message and said the chain remained at risk until every node was patched. The return followed a subsequent exchange of messages conducted through Bitcoin transactions between the actors and Blockstream, the developer of the Liquid sidechain, which culminated in a signed message from Blockstream confirming that bridge nodes were patched and safe.
The actors then transferred 3,400 BTC to the Liquid Federation address, having previously offered to return “most” of the Bitcoin without explaining why they retained the rest.
Liquid Network recovered 3,400 BTC
Bitcoin News Today: Liquid’s $47M Question – Recovered Funds But Unresolved Trust
Hacker Message
This latest Bitcoin news reopens long-standing security concerns in crypto. Liquid operates as a side-chain secured by a federation wallet and a set of bridge nodes, both of which were taken offline once the abnormal withdrawal was detected. L-BTC deposits and withdrawals remain suspended, and the network has given no public timeline for restoring normal service, leaving users unable to move assets through the peg in the interim – a reminder of how difficult full accounting becomes after a large-scale Bitcoin hack disrupts a live settlement layer.
Ledger Chief Technology Officer Charles Guillemet publicly questioned the white-hat framing after most of the funds were returned, characterizing the retention of roughly 600 BTC as inconsistent with a genuine bug-bounty arrangement and describing it as closer to extortion than white-hat hacking. His skepticism echoes broader unease in the industry about how attacker-controlled funds get labeled after the fact, a pattern also visible in prior incidents where large Bitcoin sums were stolen from numerous addresses before any resolution was reached.
Liquid has not said whether the remaining coins will be returned, how any gap in L-BTC backing will be covered, or when the sidechain and its peg services will resume normal operations.
