Liquid sidechain recovers 3,400 BTC after hacker returned part of drained funds

Bitcoin's Liquid sidechain received a partial recovery of 3,400 BTC on September 7, returning the coins to its federation wallet after a large reserve drain.

Recovery transaction details

The transaction was confirmed at 16:09:25 UTC in Bitcoin block 965950. It moved roughly 3,998.5 BTC from the hacker’s address, sending 3,400 BTC back to the federation and retaining about 598.5 BTC (approximately $47 million at the time) at the hacker’s address.

Hacker’s on‑chain message

Before the transfer, the self‑described white‑hat hacker posted an on‑chain note stating they were “sending most back” to Liquid’s federation address and asked “is that ok?” The retained amount was not identified as an agreed bounty.

Current status of the bridge

By September 8, Blockstream’s status page still reported an active Liquid security incident and a major outage affecting public bridge nodes. The outage means withdrawal services remain paused, and exchanges have halted or plan to halt L‑BTC deposits and withdrawals.

Implications for L‑BTC holders

Liquid’s redemption process requires burning L‑BTC and releasing Bitcoin through the federation. The 3,400 BTC return adds to the backing wallet, but full backing can only be confirmed after the reserves are reconciled and bridge services are restored.

Next steps

• Confirm that bridge nodes are fully operational.
• Reconcile the federation’s Bitcoin reserves with the outstanding L‑BTC supply.
• Resume deposit and withdrawal services on participating exchanges.