Hackers Return 85% of Stolen Bitcoin from Last Week’s Bridge Attack

Blockstream confirmed that the attackers behind the recent Liquid sidechain breach returned 3,400 Bitcoin, representing roughly 85% of the 3,998 BTC moved out of the network over the weekend. Approximately 598 BTC remain in the attackers’ address.

Background on the Liquid Bridge

Liquid is a Bitcoin sidechain operated by Blockstream. Users lock Bitcoin on the main chain and receive L‑BTC, a token that can be transferred more quickly and with greater privacy. Normally, moving Bitcoin out of the bridge requires sign‑off from 11 of the 15 companies that run Liquid.

Attack and Patch Sequence

The attackers set a condition that Blockstream first fix a vulnerability and ensure all bridge nodes were updated. After the patch, the stolen funds were sent to a new address. Blockstream posted a signed Bitcoin transaction on Monday morning confirming the bridge nodes were patched and that the funds were safe to return.

Returned Funds

The return transaction was recorded in Bitcoin block 965,950 at 19:09 UTC. The 3,400 BTC were transferred back within hours of the patch confirmation.

Remaining Stolen Coins

About 598.5 BTC, valued at roughly $47 million based on a Bitcoin price near $79,100, remain with the attackers. Neither Blockstream nor the attackers have provided an explanation for the retained amount.

Impact on Liquid Operations

Following the incident, Blockstream shut down the bridge and asked exchanges to freeze L‑BTC deposits and withdrawals. No timeline has been given for when the bridge service will resume or how the missing funds will be covered.