Liquid Network has recovered 3,400 BTC following an abnormal withdrawal of nearly 4,000 BTC, but about 598.5 BTC remains linked to the incident. The network’s L-BTC peg services also remain suspended, with no timeline yet given for their return.
The recovered Bitcoin is worth roughly $269.2 million and represents about 85% of the funds involved. The coins were sent back to Liquid’s federation wallet by the individuals who carried out the withdrawal and later identified themselves as white-hat hackers.
Around 598.5 BTC, valued at approximately $47 million, is still held at an address connected to the incident. Liquid has not confirmed whether those coins will be returned or explained how it would deal with any potential shortfall in L-BTC reserves.
As a result, the incident remains only partially resolved. While the majority of the Bitcoin has been recovered, uncertainty remains around the outstanding funds, the status of Liquid’s backing and when normal operations will resume.
How the Liquid Bitcoin Incident Happened
The incident began Sunday when a user transferred 4,000 L-BTC to SideSwap’s peg-out service. The transaction triggered an unexpected withdrawal from Liquid’s federation reserves.
Liquid responded by taking its bridge nodes offline and asking exchanges to pause L-BTC deposits and withdrawals. The measures were designed to contain the incident while developers investigated the unusual transaction and secured the affected infrastructure.
The parties behind the withdrawal later described themselves as white hats in an on-chain message. They claimed the network remained vulnerable until all relevant nodes had been patched.
Communication between the group and Blockstream, which develops the Liquid sidechain, took place through Bitcoin transactions. The exchange eventually led to Blockstream signing a message confirming that the bridge nodes had been patched and were considered safe.
The group subsequently returned 3,400 BTC to Liquid’s Federation address. They had previously indicated that most of the Bitcoin would be returned but provided no clear explanation for retaining the remaining funds.
The episode has renewed concerns about the security of Bitcoin sidechains and their supporting infrastructure. Liquid relies on a federation wallet and bridge nodes to operate its network, both of which were taken offline after the abnormal withdrawal was detected.
L-BTC deposits and withdrawals remain halted, preventing users from moving assets through the peg. Liquid has not yet disclosed when those services will resume.
Ledger Chief Technology Officer Charles Guillemet has also disputed the white-hat characterization. He argued that retaining roughly 600 BTC after returning most of the funds is difficult to reconcile with a traditional bug-bounty arrangement and instead resembles extortion.
The comments add to broader industry concerns over how partially recovered funds should be classified following major crypto exploits.
For now, Liquid has not disclosed whether the remaining 598.5 BTC will be recovered, how any potential L-BTC reserve deficit would be addressed, or when its sidechain and peg services will return to normal.
