Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC

Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin's public record shows. About 598.5 bitcoin has not come back.

Liquid is a Bitcoin sidechain that holds real bitcoin to back a token called L-BTC. The network is still paused, so holders cannot turn that token back into bitcoin.

The 3,400 bitcoin was sent to a Liquid Federation address at 16:09 UTC on September 7, about 85% of what was taken. The federation is the group of operators that holds the bitcoin backing L-BTC.

The remaining 598.5 bitcoin was not a separate payment. It is the change from that same transaction, sent back to the address the funds had come from. It was still there on September 8, according to the block explorer mempool.space.

Neither Blockstream nor Liquid Network has said publicly whether that bitcoin is part of an agreement.

In an incident notice, Blockstream, which provides the technology for Liquid, said hackers who claim to be white hats took about 4,000 bitcoin from the federation wallet. It put the value at about $320 million at the time.

The withdrawal took roughly 95% of Liquid's reported bitcoin reserves, which stood at about 4,200 bitcoin beforehand, The Block reported.