Alleged “Ethical Hackers” Returned 3,400 Bitcoin to the Liquid Network

• The party behind the Liquid Network incident returned 3,400 BTC to the federation address.
• About 598.5 BTC worth roughly $47 million remains under its control.
• Blockstream has rolled out updated software, but Liquid Network has not yet been restored.
• The federation is preparing the network for a coordinated restart.

The party controlling the bitcoin withdrawn from Liquid Network returned 3,400 BTC worth about $268 million to the federation address. The transfer took place after Blockstream reported that it had fixed a vulnerability on the bridge nodes.

As a reminder, on September 6, 2026, about 4,000 BTC worth roughly $320 million was withdrawn from the Liquid Network federation wallet. The project team said the hackers obtained the funds via the SideSwap PAK mechanism, but found no signs of key compromise. 

Later, SideSwap said the L-BTC used for the peg-out appeared as a result of a bug in the Elements software.

The party that received the funds called itself “ethical hackers” and began communicating with Blockstream via on-chain messages. They said they were ready to return most of the assets after the vulnerability was fixed and the nodes were updated.

After that, Blockstream sent a signed PGP on-chain message stating that the bridge nodes had been fixed and the funds could be safely returned. Soon after, a transaction for 3,400 BTC to the federation wallet address was confirmed. It was included in block #965,950.

As a result, about 85% of the funds controlled by the party were returned. Another roughly 598.5 BTC worth about $47 million remains at the address linked to the incident. As of writing, there is no public confirmation that these assets represent an agreed-upon reward for discovering the vulnerability.

Liquid Network Remains Suspended

After the incident, the Liquid Network team officially announced that it had taken the bridge nodes offline. As a result, sending new transactions became impossible, and the sidechain effectively halted. Exchanges were also advised to pause L-BTC deposits and withdrawals.

Despite the return of most of the bitcoins, the network has not yet resumed normal operations. In a recent post, Blockstream said the updated software has already been deployed, but federation members are only now preparing Liquid Network for a coordinated restart.

The team is also continuing work on additional measures to strengthen the network’s security. No timeline has yet been announced for Liquid Network’s full restoration.

Сообщение Alleged “Ethical Hackers” Returned 3,400 Bitcoin to the Liquid Network появились сначала на INCRYPTED.