Self-described white-hat hackers who drained nearly all of Liquid Network's bitcoin reserves have returned 3,400 BTC while retaining roughly 598.5 BTC. The return followed an incident on September 6 when approximately 4,000 BTC left the Liquid Federation wallet backing L-BTC, representing around 95% of the reserve.
Return and Retained Funds
After Blockstream patched its bridge nodes and notified the actors the funds were safe to return, they broadcast a transaction sending 3,400 BTC to the federation address. The actors' address retained 598.49955894 BTC, with no onchain messages identifying the roughly 15% remainder as an agreed bounty.
Technical Root Cause
The incident did not involve compromised private keys. Liquid confirmed no federation keys were compromised and Sideswap said its systems were not breached. Instead, the problem traced to Elements, the Bitcoin Core fork used by Liquid nodes.
Technical reconstructions point to a range-proof verification cache bug in Elements that allowed actors to create L-BTC without the bitcoin normally required to back it. The actors conducted a 2.5 BTC dry run before approximately 4,000 L-BTC reached Sideswap's peg-out service. Sideswap processed the request normally, and Liquid's federation sent 3,996 BTC to the destination. The failure occurred during issuance rather than at the custody layer.
Unusual Negotiations
The actors communicated publicly through Bitcoin OP_RETURN messages, declaring themselves white-hats and stating they would return funds after patching. Blockstream responded with PGP-signed messages. The white-hat characterization remains contested, with some questioning the take-first-and-negotiate-later approach, though Liquid has cautiously referred to them as purported white-hat hackers.
Network Status
Liquid remains paused with bridge nodes disabled. L-BTC deposits and withdrawals at centralized exchanges remain halted. Other Liquid-issued assets, including USDT and real-world assets, were not affected. Bitcoin's main network was unaffected, and Liquid wallets experienced disruptions only for Liquid functionality.
A network restart may proceed once operators verify legitimate L-BTC is backed 1:1, distribute a patched Elements release, and determine it is safe to reopen the bridge. Approximately 598.5 BTC remains under the actors' control with no published agreement on its return.
