Alleged "Ethical Hackers" Returned 3,400 Bitcoin to the Liquid Network

• The party behind the Liquid Network incident returned 3,400 BTC to the federation address.
• About 598.5 BTC worth roughly $47 million remains under its control.
• Blockstream has rolled out updated software, but Liquid Network has not yet been restored.
• The federation is preparing the network for a coordinated restart.

The party controlling the bitcoin withdrawn from Liquid Network returned 3,400 BTC worth about $268 million to the federation address. The transfer took place after Blockstream reported that it had fixed a vulnerability on the bridge nodes.

As a reminder, on September 6, 2026, about 4,000 BTC worth roughly $320 million was withdrawn from the Liquid Network federation wallet. The project team said the hackers obtained the funds via the SideSwap PAK mechanism, but found no signs of key compromise. 

Later, SideSwap said the L-BTC used for the peg-out appeared as a result of a bug in the Elements software.

The party that received the funds called itself “ethical hackers” and began communicating with Blockstream via on-chain messages. They said they were ready to return most of the assets after the vulnerability was fixed and the nodes were updated.

After that, Blockstream sent a signed PGP on-chain message stating that the bridge nodes had been fixed and the funds could be safely returned. Soon after, a transaction for 3,400 BTC to the federation wallet address was confirmed. It was included in block #965,950.