Liquid Hackers Return 3,400 BTC, Keep $47M as Network Stays Frozen

The return marks a significant turn in an incident that began Sunday, Sept. 6, when roughly 4,000 BTC, then worth about $320 million, left the Liquid Federation wallet backing L-BTC. That represented around 95% of the reserve, leaving only about 197 BTC behind.

3,400 BTC Comes Back, but 598.5 BTC Stays Put

After Blockstream told the actors its bridge nodes had been patched, and the funds were “safe to return,” they broadcast a transaction sending 3,400 BTC to the federation address. The actors’ address retained 598.49955894 BTC, and nothing in the onchain messages identified that roughly 15% remainder as an agreed bounty.

Interestingly, this was not a classic case of hackers stealing private keys and emptying a wallet. Liquid said no federation keys were compromised, while Sideswap said its systems were not breached. Instead, the problem traced back to Elements, the Bitcoin Core fork used by Liquid nodes.

Elements Bug Opened the Door to Unbacked L-BTC

Independent technical reconstructions point to a range-proof verification cache bug that apparently allowed the actors to create L-BTC without the bitcoin normally required to back it. In layman’s terms, the system accepted bitcoin-like tokens that should never have existed, and those tokens were later exchanged for real bitcoin from Liquid’s reserves.

The actors first conducted a 2.5 BTC dry run before roughly 4,000 L-BTC reached Sideswap’s peg-out service at 14:05 UTC. Sideswap processed the request normally, burning the L-BTC and requesting payment, and Liquid’s federation sent 3,996 BTC to the destination at 14:28 UTC.

There’s a great deal riding on the distinction. Liquid’s federation signers behaved as designed when presented with a valid withdrawal request. The failure occurred earlier, when unbacked L-BTC entered the system, meaning the incident centered on issuance rather than compromised custody keys.

Blockstream and the Actors Negotiate on Bitcoin

What followed was anything but a normal security disclosure. The actors communicated publicly through Bitcoin OP_RETURN messages, first declaring, “we are whitehats. contact us on chain.” Blockstream eventually responded with PGP-signed messages, and the actors said they would return the funds after the network was patched.

Alongside this, the white-hat description remains contested. Ledger CTO Charles Guillemet questioned the take-first-and-negotiate-later approach, although he later acknowledged the actors could be inexperienced researchers. Liquid itself has cautiously called them “purported white-hat hackers.”

Liquid Stays Frozen as Operators Face the Next Test

The 3,400 BTC return takes a great deal of pressure off the reserve problem, but Liquid is not out of the woods yet. The network remains paused, bridge nodes are disabled and L-BTC deposits and withdrawals at centralized exchanges remain halted. Other Liquid-issued assets, including USDT, Depix, and real-world assets (RWAs), were not touched.

On the other hand, Bitcoin’s main network was unaffected, and Liquid wallets such as Aqua are disrupted only for their Liquid functionality. About 598.5 BTC remains under the actors’ control, with no published agreement explaining whether those funds will eventually return.

A restart may be in the cards once operators can prove legitimate L-BTC is again backed 1:1, distribute a patched Elements release across the network, and decide it is safe to reopen the bridge. Until those steps are complete, the dust has hardly settled on one of Liquid’s biggest technical crises.