Hacker Returns Most of $260M Liquid Bitcoin Bridge Theft, but Withdrawals Remain Frozen

Blockstream's Liquid sidechain, a Bitcoin-linked network used to issue the L-BTC token, suffered a major reserve drain that triggered a security incident and outage across its public bridge nodes. On September 7, an on-chain message from the attacker, describing themselves as a white-hat hacker, said they were 'sending most back' before a transaction returned 3,400 BTC to Liquid's federation wallet. Approximately 598.5 BTC, worth around $47 million, was kept by the attacker's address, and it is not confirmed whether this was an agreed bounty.

A separate on-chain message claimed the bridge nodes had been patched and that funds were safe to return, and its signature reportedly verifies against Blockstream's security key. However, this patch claim does not confirm that withdrawal services have actually reopened. As of September 8, Blockstream's status page still listed an active security incident and a major outage affecting public bridge nodes.

The returned Bitcoin adds to Liquid's backing reserves, but full backing for outstanding L-BTC tokens has not yet been confirmed, since ordinary users typically rely on authorized members or partner services to redeem L-BTC for Bitcoin. Exchanges and services such as SideSwap have paused deposits, withdrawals, and swaps until Liquid confirms operations have fully resumed.