Liquid recovers 3,400 BTC from hackers

Liquid Network said 3,400 bitcoin were returned on Monday after talks conducted on-chain with the party that drained nearly 4,000 BTC from the federation wallet backing the Bitcoin sidechain. Crypto outlets including The Block, Bitcoin Magazine and Bitcoin.com reported the return, citing wallet activity and statements from people involved in the response. Blockstream, the network’s technical provider, said bridge nodes were disabled and the sidechain was effectively paused while federation members worked on the incident. ### What exactly was recovered, and what was not? The returned amount was 3,400 BTC, which multiple crypto news outlets reported was sent back on September 7 after the attacker said most of the funds would be returned once the underlying issue was patched. Those same reports said roughly 598.5 BTC remained with the attacker, leaving about 15% of the original haul unrecovered. (theblock.co) The initial withdrawal was described as about 4,000 BTC from the Liquid federation wallet that backs L-BTC, the bitcoin representation used on the sidechain. Bitcoin.com and The Block both said the incident began on September 6 and involved nearly all of the reserves backing L-BTC on the network. ### Why were people calling this an on-chain negotiation? (theblock.co) The attacker described themselves as a white hat in coverage cited by The Block and Bitcoin Magazine, and the return followed messages and transactions visible on-chain rather than a conventional public legal process. Bitcoin Magazine reported that Liquid credited on-chain talks for the return, while The Block said the attacker returned the coins after Blockstream said bridge nodes had been patched. (news.bitcoin.com) The “white hat” label remains the attacker’s characterization, not an official finding by Blockstream in the material reviewed. Coverage from multiple outlets said the party kept 598.5 BTC after the return, which those reports described as an implied bounty or retained portion of the exploit proceeds. ### What is Liquid Network, and why did this hit matter? (bitcoinmagazine.com) Blockstream says Liquid is a Bitcoin layer-2 network used for digital asset issuance and faster, more confidential settlement on top of Bitcoin. Its help materials say the network is operated by a federation of functionaries, with 15 specialized devices run by federation members around the world. Because L-BTC on Liquid is meant to be backed by bitcoin held in federation-controlled wallets, the loss of those reserves immediately raised questions about the peg and the network’s ability to process normal transfers. (theblock.co) Bitcoin.com said operators were working to restore one-to-one backing, and Blockstream’s incident page said no new transactions could be submitted while bridge nodes were disabled. (blockstream.com) ### Was the network still running after the coins came back? Blockstream’s incident page said on September 7 that Liquid was “effectively” paused until the issue was resolved and that wallets would be impacted. On September 8, Blockstream’s public status page still showed Liquid in a major outage and listed public bridge nodes as affected. Other assets on the network, including USDT, DePix and RWAs, were described by Blockstream as unaffected by the specific security incident. (news.bitcoin.com) The operational problem, according to the company’s status update, was centered on Liquid transaction submission and bridge-node availability. ### What happens next? September 8 is the next concrete checkpoint because Blockstream’s status page remained the main public source for whether Liquid bridge nodes would be restored and the outage cleared. (status.blockstream.com) The unresolved figure is 598.5 BTC, the amount multiple reports said was still held back after the September 7 return. (status.blockstream.com)