3,400 BTC Flow Into Liquid Network Following Hack, but Peg Services Stay Shut

Liquid Network has recovered 3,400 BTC following an unusual withdrawal of nearly 4,000 BTC, but around 598.5 BTC remains associated with the incident. L-BTC deposits and withdrawals are still suspended, and Liquid has not provided a date for restarting its peg services.

The returned Bitcoin is worth approximately $269.2 million, representing about 85% of the funds involved. The individuals behind the withdrawal later described themselves as white-hat hackers before sending the coins back to Liquid’s federation wallet.

However, about 598.5 BTC, valued at nearly $47 million, remains at an address linked to the incident. Liquid has not said whether those funds will be returned or explained how it plans to address any potential gap in the Bitcoin backing L-BTC.

The partial recovery means the incident is not fully resolved. Questions remain over the remaining funds, the status of Liquid’s reserves and when the network’s normal services will be restored.

How the Liquid Bitcoin Incident Unfolded

The incident began Sunday when a customer sent 4,000 L-BTC to SideSwap’s peg-out service. The transaction triggered an unexpected withdrawal from Liquid’s federation reserves.

After detecting the unusual activity, Liquid shut down its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals. The emergency measures were intended to prevent further losses while developers investigated the incident and secured the network.

The parties responsible for the withdrawal later identified themselves as white hats through a message recorded on the Bitcoin blockchain. They warned that the network remained vulnerable until its nodes were patched.

Blockstream, the developer behind Liquid, communicated with the group through a series of Bitcoin transactions. The exchanges eventually resulted in a signed message from Blockstream confirming that the bridge nodes had been patched and were considered secure.

The group subsequently returned 3,400 BTC to Liquid’s Federation address. They had earlier indicated that most of the Bitcoin would be returned but did not provide a clear reason for keeping the remaining funds.

The incident has renewed concerns about the security of Bitcoin sidechains and their underlying infrastructure. Liquid relies on a federation wallet and bridge nodes to facilitate operations, and both were taken offline after the abnormal withdrawal was discovered.

L-BTC deposits and withdrawals remain frozen, leaving users unable to transfer assets through Liquid’s peg. The network has not disclosed when these services will become available again.

Ledger Chief Technology Officer Charles Guillemet has also challenged the white-hat label. He argued that retaining roughly 600 BTC after returning the majority of the funds does not resemble a typical bug-bounty arrangement and is instead closer to extortion.

His comments reflect wider concerns within the crypto industry over how attackers should be classified when they return only part of the assets involved in an exploit.

For now, Liquid has not clarified whether the remaining 598.5 BTC will be recovered, how a potential L-BTC backing shortfall would be addressed, or when its sidechain and peg services will resume.