Liquid exploit: 3,400 BTC returned, 598.5 BTC still missing

CoinDesk reported that the Liquid Network incident is moving toward resolution in stages. The address that withdrew roughly 4,000 BTC has sent 3,400 BTC back to the Liquid Federation wallet—about $269.2 million at the article's cited price—recovering around 85% of the funds tied to the event. About 598.5 BTC, valued near $47 million, remains in the withdrawal-linked address. The episode began with a SideSwap peg-out. On Sunday, a customer sent 4,000 LBTC to SideSwap's peg-out service, after which an equivalent amount of BTC was withdrawn. The party behind the withdrawal later embedded a message in a Bitcoin transaction identifying themselves as "whitehat hackers," saying the move was meant to highlight security weaknesses. In response, Liquid shut down its bridge node and asked exchanges to halt LBTC deposits and withdrawals to limit additional risk. Before the return of funds, Blockstream—developer of the Liquid sidechain—used Bitcoin transaction data to communicate with the relevant addresses. Blockstream then published a signed message stating the bridge node had been fixed and that returning the funds was safe. After that message, 3,400 BTC was transferred back to the Liquid Federation address. The actors had previously said they would return "most" of the bitcoin, without publicly explaining why the remainder was kept. The destination of the nearly 600 BTC still unaccounted for remains unclear. Key questions are still open, including whether the remaining BTC will be returned, how any LBTC reserve shortfall will be covered, and when Liquid's sidechain and peg services will resume normal operations. Ledger CTO Charles Guillemet questioned the "white hat" framing, writing on X that if there was no pre-arranged onchain bounty and roughly 600 BTC is being withheld, it looks more like coercion than standard whitehat behavior. As of publication, Blockstream had not provided additional comment to international media, and Liquid had not released a timeline for restoring normal service.