White-Hat Hackers Return Majority of Stolen Bitcoin Following Liquid Network Breach
The white-hat hackers responsible for Sunday’s exploit of the Liquid Network have largely fulfilled their commitment, returning most of the drained bitcoin after the federation moved to patch the vulnerability.
3,400 BTC Returned, $47 Million Still Outstanding
According to information shared by Liquid’s Samson Mow, the attackers have returned 3,400 of the 4,000 BTC they withdrew on Sunday. Approximately 598 BTC, valued at roughly $47 million at current prices, remains outstanding.
Liquid Network Exploit Drained Nearly Entire Federation Reserve
Liquid Network, a Bitcoin sidechain developed by Blockstream, suffered a significant security incident on Sunday when attackers withdrew 4,000 BTC—worth approximately $320 million at the time—from the federation wallet that backs the network’s native token, L-BTC. The network functions as a faster, more private settlement layer built on top of Bitcoin.
The federation is supported and maintained by a consortium of major cryptocurrency companies, including exchanges and miners. Under normal operations, every L-BTC token is matched one-for-one with real bitcoin locked in a shared multisignature wallet.
Reserve Backing Collapsed to 197 BTC
Sunday’s hack drained almost the entire reserve stash of approximately 4,200 BTC, leaving only 197 BTC in the federation wallet. This effectively meant L-BTC was suddenly far from fully backed, breaking the fundamental 1:1 peg guarantee.
Emergency Response: Bridge Nodes Disabled, Network Paused
In response to the breach, federation operators immediately disabled bridge nodes, paused the network, and instructed exchanges to freeze L-BTC deposits and withdrawals. Other assets issued on Liquid, including Tether (USDT), were not affected by the exploit.
