TLDR
White hat hackers have returned about $270 million in Bitcoin to Blockstreams Liquid Network after a major sidechain exploit, but roughly $47 million in BTC is still missing or disputed.
- Around 4,000 BTC was drained from Liquids reserves via a software bug, and 3,400 BTC has now been sent back, leaving approximately 598.5 BTC outstanding.
- The core Bitcoin chain was not hacked, but the incident exposes serious risks in sidechains and bridges that promise one-to-one BTC backing.
- Liquid remains paused while Blockstream negotiates over the remaining funds and prepares an emergency update and coordinated network restart, with L-BTC users still unable to redeem normally.
Deep Dive
1. Scale And Mechanics Of The Exploit
The Liquid Network exploit saw nearly 4,000 BTC, about $320 million, leave its federation reserves after unbacked L-BTC was created due to a bug in the Elements software and redeemed via SideSwaps peg-out service, even though no private keys were stolen and the peg-out authorization key remained intact, according to a detailed Liquid Network incident report.
Self-described white hats then communicated via on-chain Bitcoin messages, and after Blockstream confirmed a patch for bridge nodes, they returned 3,400 BTC, roughly $269 million, to the federation wallet, while about 598.5 BTC, around $47 million, remains at an associated address as reported by Coinspeaker.
Some industry voices, including Ledgers CTO, question whether retaining nearly 600 BTC is compatible with a white hat label, arguing it looks closer to extortion than a standard bug bounty.
2. Sidechain Risk And Bitcoin Itself
The exploit did not affect the Bitcoin base layer; the loss occurred in Liquids custodial reserves, not in Bitcoin consensus or keys on the main chain.
However, Liquids model depends on L-BTC being fully backed by BTC in the federation wallet, and this incident shows that a bug in validation logic can break that promise even when keys are secure, undermining confidence in pegged assets and bridge infrastructure more broadly.
A broader analysis of the hack and similar bridge incidents notes that repeated exploits at the infrastructure layer are already shaping institutional views on whether crypto settlement layers are ready for mainstream finance, as highlighted in coverage of bridge and sidechain hacks.
Holding BTC on a sidechain carries additional software and governance risk beyond normal Bitcoin custody, and backed tokens are only as safe as their bridge logic and operators.
3. What Users Should Watch Next
Liquid has disabled bridge nodes and L-BTC deposits and withdrawals, and Blockstream says federation members are preparing a coordinated restart with updated software that will reject the invalid withdrawal and further harden the network, but no firm timeline has been announced.
Negotiations continue with the parties holding the remaining ~598.5 BTC, and there is no public agreement yet on whether those coins will be returned, treated as a bounty, or covered by the federation.
For L-BTC users and traders, the key signals will be: an official restart announcement, clarity on how the backing gap is resolved, and proof that L-BTC supply matches reserves before trusting peg-ins or peg-outs again.
Until Liquid publishes a clear restart plan and accounting of reserves, users should treat L-BTC liquidity and redeemability as impaired and monitor official updates rather than assuming business as usual.
Conclusion
Most of the Bitcoin drained from the Liquid Network has been recovered, but the combination of a complex software bug, partial fund retention, and a paused bridge highlights how much additional risk sits in sidechains compared with holding BTC directly.
The outcome of negotiations over the remaining BTC and the robustness of Liquids restart will be a key test of whether federated sidechains can sustain trust after a major failure, and it will shape how seriously institutions treat bridge risk in their Bitcoin strategies.
CoinsKid.Com