Liquid Network has received 3,400 BTC back from the group believed to be responsible for Sunday’s security breach, while approximately 598 BTC worth nearly $47 million remains outstanding.
The unidentified attackers, who have referred to themselves as whitehat hackers, have returned most of the 4,000 BTC taken from the network after Liquid began fixing the vulnerability that enabled the exploit.
According to Samson Mow, around 3,400 BTC has been transferred back to Liquid’s federation wallet, leaving roughly 598 BTC still in the hands of the attackers. Blockstream remains in communication with the group as it works through the aftermath of the breach.
Liquid, a Bitcoin sidechain developed by Blockstream, was compromised Sunday after approximately 4,000 BTC worth about $320 million was withdrawn from the federation wallet that provides backing for L-BTC. The network was created to offer faster and more private settlement capabilities on top of Bitcoin.
Its infrastructure is managed by a federation made up of major crypto companies, including exchanges and mining firms. The model requires every L-BTC to be backed by an equivalent amount of bitcoin held in the federation’s shared wallet.
Before the exploit, the wallet contained roughly 4,200 BTC. The attack removed almost the entire reserve, leaving only about 197 BTC and creating a major shortfall in the bitcoin backing for L-BTC.
Liquid quickly disabled its bridge nodes and suspended network activity following the incident. Exchanges were instructed to halt L-BTC deposits and withdrawals as a precaution. Other assets issued on Liquid, including Tether, were not affected.
Mow, a prominent Bitcoin advocate and former chief strategy officer at Blockstream, said Monday that negotiations with the hackers were still ongoing. He explained that the network would remain paused while Blockstream and federation members completed additional security improvements, dealt with the chain split and prepared for a safe restart.
The hackers used Bitcoin transactions to communicate publicly during the negotiations. Once Blockstream confirmed that the vulnerable bridge nodes had been patched, the group sent 3,400 BTC back to the federation wallet but kept the remaining funds.
The recovery has eased Liquid’s immediate collateral problem, but the network is not yet ready to resume normal operations.
Before restarting, Liquid must finish its security upgrades, resolve the chain split created during the shutdown and ensure users can once again have confidence in the bitcoin backing behind L-BTC.
Mow advised users to wait for an official restart announcement and warned them not to send BTC to Liquid peg-in addresses until the network is confirmed to be operational.
