Liquid Network recovers 85% of stolen Bitcoin after bridge exploit

Liquid Network, the Bitcoin sidechain operated by Blockstream, announced that it has retrieved 3,400 BTC – roughly 85% of the 4,000 BTC withdrawn in a recent bridge exploit. The recovered coins are valued at about $269 million, leaving an estimated $47 million (598.5 BTC) still held by the actors.

Background of the incident

The breach began when a user sent 4,000 L‑BTC to SideSwap’s peg‑out service, which moves value from the Liquid sidechain back to the Bitcoin network. The transaction triggered a vulnerability in the bridge nodes, allowing the actors to withdraw the BTC.

White‑hat claim and repayment process

The actors identified themselves as “white‑hats” in a message attached to a Bitcoin transaction, stating they would return most of the funds once Blockstream patched the affected nodes. After receiving a signed transaction message confirming the patch, the actors sent 3,400 BTC to the Liquid Federation wallet in Bitcoin block 965,950.

Remaining funds and open questions

Approximately 598.5 BTC (about $47 million) remains in the withdrawal‑linked address. Neither Blockstream nor the actors have disclosed why this portion was retained or whether further repayment will occur. No public bounty agreement or contract has been released, and the legal status of the retained coins is unclear.

Impact on Liquid services

Following the exploit, Blockstream disabled its bridge nodes and asked exchanges to suspend L‑BTC deposits and withdrawals. The bridge and L‑BTC services have not resumed, and no timeline for reopening has been provided.

Industry reaction

Ledger’s CTO Charles Guillemet questioned the “white‑hat” label, suggesting the retained funds resemble extortion rather than a standard bug bounty. The incident mirrors a similar partial repayment after the Verus Ethereum bridge exploit earlier this year.

What’s next for L‑BTC holders?

U.S. users and others face continued suspension of L‑BTC operations while Blockstream investigates the flaw. The network has not confirmed whether the returned BTC fully restores backing for the existing L‑BTC supply or how the remaining gap will be addressed.