- Trending
- Comments
- Latest
The Liquid Network has recovered 3,400 BTC worth roughly $269 million after self-described white-hat hackers withdrew 4,000 BTC through a bridge-related exploit, according to on-chain data and communications between the attackers and Blockstream. The repayment restores about 85% of the Bitcoin involved, while approximately 598.5 BTC, valued at around $47 million, remains in a withdrawal-linked address.
The recovery came after Blockstream told the actors that affected bridge nodes had been patched and that the Bitcoin was safe to return. The Liquid Network has not, however, disclosed when its bridge and L-BTC services will return to normal operations or provided a complete technical explanation of the vulnerability.
The 3,400 BTC repayment was recorded in Bitcoin block 965,950, with the funds transferred to the Liquid Federation wallet. At the time the transaction was confirmed, the returned Bitcoin was worth approximately $268.2 million.
The transaction left roughly 598.5 BTC in the address associated with the original withdrawal. The actors have not publicly explained why they retained those funds or confirmed whether another repayment is planned.
The incident began when a customer sent 4,000 Liquid Bitcoin, or L-BTC, to SideSwap’s peg-out service on Sunday. SideSwap enables users to move assets from the Liquid sidechain back to the Bitcoin network through an authorized withdrawal process.
The actors subsequently described themselves as “whitehats” in a message attached to a Bitcoin transaction. The term generally refers to security researchers who identify vulnerabilities and help affected projects resolve them, sometimes receiving an agreed bounty.
However, there is no publicly disclosed agreement showing that the actors were authorized to withdraw the Bitcoin or entitled to retain part of it as a reward. Neither Blockstream nor the actors have published terms establishing a bounty or authorizing the retention of nearly 600 BTC.
Before the repayment, the actors had offered to return “most” of the Bitcoin after Blockstream fixed the vulnerability. At the time, no repayment had been confirmed, and the withdrawal represented approximately 95% of the Bitcoin reportedly held in the federation wallet.
The Liquid Network incident also highlighted how Bitcoin transaction messages can be used to communicate during a security crisis. Blockstream and the actors exchanged instructions through messages attached to Bitcoin transactions rather than relying on a private communications channel.
In one transaction message, the actors demanded that Blockstream repair the vulnerability before they returned the funds.
“Please fix the bug first,” the message said. “The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
Blockstream subsequently informed the actors through a signed transaction message that its bridge nodes had been patched and that the funds were “safe to return.” The actors then transferred 3,400 BTC to the Liquid Federation address.
The exchange suggests that the repayment was conditional on the actors receiving confirmation that the affected infrastructure had been secured. Still, neither side has released a technical report identifying the vulnerability or explaining precisely how the withdrawal was executed.
Following the incident, Liquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals. The measure restricted transfers between Liquid and the Bitcoin base layer while developers investigated the incident and applied the necessary patch.
According to Reuters, Blockstream has said the key used during the withdrawal was not compromised. The company has yet to publish a full post-mortem establishing whether the vulnerability involved SideSwap, bridge software, Liquid’s Elements codebase or another component of the peg-out process.
The Liquid Network recovery has not ended questions over whether the actors should be regarded as legitimate white-hat researchers.
Ledger Chief Technology Officer Charles Guillemet questioned the characterization after 3,400 BTC was returned while nearly 600 BTC remained under the actors’ control.
“So, 3,400 BTC were refunded,” — Charles Guillemet, Ledger chief technology officer, on X. “The ‘white hats’ still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!”
Guillemet’s criticism centers on the absence of publicly disclosed terms governing the retained Bitcoin. In conventional bug-bounty arrangements, researchers generally receive a reward under agreed conditions rather than taking custody of assets exposed by a vulnerability.
The distinction is particularly relevant because Blockstream has not said that the remaining 598.5 BTC represents an approved bounty.
A similar situation occurred after the Verus Ethereum bridge exploit in May, when an attacker returned 75% of the stolen assets and retained 1,350 ETH after Verus publicly offered settlement terms. The circumstances surrounding the Liquid Network incident differ because no comparable settlement agreement has been made public.
The actors’ claim that they are white hats also does not, by itself, establish their legal status. Any legal determination could depend on authorization, how the assets were obtained, communications between the parties and applicable law. No U.S. regulator or law enforcement agency has announced an action connected to the withdrawal.
The Liquid Network is a federated Bitcoin sidechain developed by Blockstream. Through its peg mechanism, users lock Bitcoin and receive L-BTC on Liquid at a one-to-one ratio, enabling faster transfers and settlement without recording every transaction directly on the Bitcoin blockchain.
The incident demonstrates the importance of the infrastructure connecting sidechains with their underlying assets. Bridge systems depend on secure custody, validation and message-processing mechanisms, meaning a vulnerability in one component can disrupt withdrawals even if the underlying Bitcoin network continues operating normally.
For L-BTC holders, the immediate concern is operational. Liquid has not announced when its bridge nodes will resume normal operations, and exchanges have been asked to maintain the suspension of L-BTC deposits and withdrawals.
The Liquid Network has also not publicly confirmed whether the 3,400 BTC returned to the federation wallet fully restores backing for the corresponding L-BTC supply. Nor has it explained how any shortfall associated with the remaining 598.5 BTC will be addressed.
The absence of a reopening timetable leaves users waiting for further information from Blockstream and Liquid. A complete technical post-mortem could clarify how the exploit occurred, which systems were affected and what measures have been implemented to prevent a recurrence.
For now, the return of 3,400 BTC represents a substantial recovery, but the Liquid Network remains confronted by two unresolved issues: the fate of the remaining Bitcoin and the lack of a detailed public explanation of the vulnerability.
Until those questions are addressed, the incident remains both a significant asset recovery and an unresolved security event for Liquid’s bridge infrastructure.
Copyright © 2025 - The Bit Gazette.
