Liquid Network Recovers Most of Stolen Bitcoin, but 598 BTC Still Missing

Bitcoin Layer 2 network Liquid has recovered 3,400 BTC of the approximately 4,000 BTC (worth around $320 million) that was withdrawn from its Federation wallet during a security incident. Those responsible, describing themselves as white-hat hackers, had said they would return the funds once Blockstream patched the affected bridge nodes. After confirming the patches were applied, most of the Bitcoin was sent back, though 598 BTC is still outstanding and discussions with the parties involved are ongoing.

The funds were originally moved using the SideSwap Peg-out Authorization Key (PAK) process, though Liquid says the core Peg-out Authorization Key itself was not compromised. In response, exchanges paused or prepared to pause LBTC deposits and withdrawals, and Liquid disabled its bridge nodes, effectively halting the sidechain while Blockstream and Federation members work through further security hardening, a chain split, and preparations for a coordinated restart. Users have been told not to send Bitcoin to Liquid peg-in addresses until the network confirms it is back online.

The incident has sparked debate about the true nature of the return. Ledger CTO Charles Guillemet suggested the outstanding funds could relate to a negotiated reward agreed via an on-chain contract, which he said would resemble extortion rather than genuine white-hat behaviour. Podcast host Isabel Foxen Duke went further, calling the actors' conduct 'insanely illegal/unethical' and warning they could still face legal consequences if identified.

Key Takeaway: Businesses using cryptocurrency platforms or bridges should treat any pause in service as a signal to hold off on transactions until the provider explicitly confirms systems are secure and fully restored.