Liquid Network hackers agree to return BTC

TLDR

Hackers who drained nearly 4,000 BTC from Blockstreams Liquid Network have now returned most of it, but a sizable gap and a network freeze remain.

1. Self-described white-hat attackers have reportedly returned 3,400 BTC and kept about 598.5 BTC, roughly 85 percent of the haul.
2. The exploit used a software bug in Liquids bridge stack, not stolen keys, so Bitcoins main chain is intact but trust in the L-BTC peg is stressed.
3. Key unknowns are whether the remaining BTC is ever repaid, how Liquid restores full backing, and when exchanges and the bridge fully reopen.

Deep Dive

1. What Was Returned

Over the weekend, actors calling themselves white-hat hackers withdrew close to 4,000 BTC, around 95 percent of Liquid Networks federation reserves, via a large peg-out transaction.

After on-chain negotiations with Blockstream, multiple reports say the attackers have sent back 3,400 BTC, worth about 268 to 270 million dollars, but kept roughly 598.5 BTC, about 47 million dollars.

There is no public evidence of a formal bounty deal, and several security voices have questioned whether keeping 15 percent of the funds is consistent with standard white-hat practice.

2. How The Exploit Worked And Who Is Affected

Liquid is a federated Bitcoin sidechain that issues L-BTC, a token backed 1:1 by BTC held in a multisig federation wallet.

According to technical write-ups, the attackers abused a bug in Elements (the Bitcoin fork powering Liquid) that let them create unbacked L-BTC, then redeem it through a legitimate peg-out service for real BTC, without compromising federation keys.

Liquid has paused its bridge nodes, and exchanges have suspended L-BTC deposits and withdrawals, while other assets issued on Liquid (like USDT or tokenized RWAs) reportedly were not directly drained but are impacted by the wider halt.

3. What To Watch Next

Several practical questions now drive the risk profile.

1. Whether the remaining ~598.5 BTC is ever returned or effectively treated as an informal bounty or unrecoverable loss.
2. How Liquid communicates the plan to restore 1:1 backing, including who eats any shortfall between L-BTC in circulation and on-chain BTC reserves.
3. When a patched Elements release is widely deployed, the bridge reopens, and major exchanges re-enable L-BTC flows.

For users, this incident is also another datapoint that large, multi-sig bridges and sidechains can fail at the software layer even when keys are safe.

Conclusion

Most of the BTC drained from Liquids federation wallet has been returned, which greatly reduces the immediate loss, but the episode still exposes structural risk in pegged Bitcoin systems. Until Liquid proves that reserves, software and operational processes are robust and clarifies the status of the remaining funds, L-BTC and similar bridge exposures should be treated as carrying additional counterparty and peg risk compared with holding native BTC on the base chain.