Liquid Network has recovered 3,400 BTC from the group claiming responsibility for Sunday’s exploit, leaving around 598 BTC, worth nearly $47 million, still unaccounted for.
The unidentified group, described as whitehat hackers, returned most of the 4,000 BTC removed from Liquid’s reserves after the network began patching the vulnerability used in the attack.
Samson Mow said 3,400 BTC had been sent back to the federation wallet, while approximately 598 BTC remains outstanding. Blockstream continues to communicate with the group as efforts to resolve the incident move forward.
Liquid Network, a Bitcoin sidechain developed by Blockstream, suffered the breach Sunday when roughly 4,000 BTC, valued at about $320 million, was withdrawn from the federation wallet backing its L-BTC token. Liquid is designed to provide faster and more private settlement for Bitcoin transactions.
The network relies on a federation of major cryptocurrency companies, including exchanges and miners. Its system is built around the principle that every L-BTC should be backed by an equivalent amount of actual BTC held in a shared federation wallet.
Before the attack, that wallet contained roughly 4,200 BTC. The exploit removed nearly the entire reserve, leaving only about 197 BTC and creating a significant gap between the L-BTC supply and its bitcoin backing.
Liquid responded by disabling its bridge nodes and halting network operations. Exchanges were also asked to suspend L-BTC deposits and withdrawals. Other assets operating on Liquid, including Tether, were not affected by the breach.
Mow, a prominent Bitcoin advocate and former Blockstream chief strategy officer, said Monday that discussions with the hackers were continuing. He said the network would remain paused while Blockstream and federation members carried out additional security upgrades, addressed the chain split and prepared for a secure restart.
The hackers communicated publicly through messages embedded in Bitcoin transactions. Following confirmation from Blockstream that the affected bridge nodes had been patched, the group returned 3,400 BTC to the federation wallet while retaining the remaining funds.
The returned bitcoin has reduced the immediate shortfall, but Liquid still has several issues to address before reopening the network.
The operators need to complete the remaining security measures, resolve the chain split that emerged during the shutdown and restore confidence that L-BTC is adequately backed before restarting operations.
Mow urged users to remain inactive for now, specifically warning them not to send BTC to Liquid peg-in addresses until Blockstream confirms that the network has officially resumed.
