Liquid Moves Toward Restart After "270M" White-Hat Bitcoin Return

Blockstream-backed Liquid is edging closer to resuming normal operations after a security incident on Sunday affected the sidechain's Bitcoin reserves. On-chain activity and industry commentary indicate that alleged "white-hat" actors have returned 3,400 BTC (about $270 million) to the Liquid Federation wallet. The funds were repaid after roughly $320 million in BTC was withdrawn from Liquid's reserve. JAN3 CEO and former Blockstream executive Samson Mow said on Monday that Blockstream confirmed patches had been applied to the affected bridge nodes. He added that about 598 BTC remains outside federation control and that Blockstream is continuing direct engagement with the parties involved. On-chain data shows 3,400 BTC was transferred back after an earlier withdrawal of about 4,000 BTC, which had reduced the reserve from roughly 4,200 BTC before Liquid paused operations. Liquid remains halted as bridge-node fixes roll out and federation members prepare a coordinated restart. Blockstream said updated software has been deployed, and that remaining issues—including a reported chain split—must be fully resolved before service resumes. The repayment is significant for Liquid's collateral position. Liquid issues LBTC against Bitcoin held by the federation; a reduction in reserves pressures the system's ability to maintain full backing for issued tokens. Returning around 85% of the withdrawn BTC restores much of the removed collateral ahead of a restart. SideSwap's pegout process and an Elements bug in focus The withdrawal reportedly moved through SideSwap's Pegout Authorization Key mechanism. Liquid and SideSwap have said the pegout key itself was not compromised. SideSwap instead linked the LBTC involved to a bug in Elements, the open-source software underpinning Liquid. Blockstream said it communicated with the actors via signed messages embedded in Bitcoin transactions. The actors described themselves as white hats and indicated they would return most funds once vulnerabilities were fixed and nodes had installed the patch. The episode also underscores Liquid's dependence on both software remediation and federation-level bridge operations: even if the issue traces back to the Elements codebase, governance over funds still hinges on federation wallet movements and chain-level confirmations. Network still paused; users told not to pegin Liquid has not yet returned to full service. Mow said the network remains paused while additional fixes and security improvements are completed, and cited efforts toward a "safe restart" coordinated among federation participants. For users, the guidance is straightforward: do not send Bitcoin to Liquid pegin addresses until Blockstream confirms the restart. Mow said no other user action is required. The warning matters because pegins rely on the bridge functioning correctly and on the federation maintaining custody and issuance between BTC reserves and LBTC. Until service is confirmed live, pegins could face delays or become stuck. Debate persists over "white-hat" claims The partial repayment has not settled questions about intent. Ledger CTO Charles Guillemet challenged the white-hat framing, arguing that if the remaining ~600 BTC amounts to a reward negotiated through encrypted on-chain communications, it could resemble extortion rather than standard vulnerability disclosure. Neither Blockstream nor Liquid has publicly described the outstanding BTC as a bounty, and no repayment terms have been disclosed. Cointelegraph reported it contacted both firms for comment but did not receive responses before publication. Markets and observers are now focused on three next steps: confirmation of a restart, continued monitoring of federation reserve movements, and clarity on whether the remaining ~598 BTC is fully recovered.