Liquid Network Exploiter Returns 3,400 BTC; About 15% Still Unaccounted For

Liquid Network has clawed back most of the bitcoin taken in a weekend exploit, according to on-chain data. A self-described white-hat attacker sent 3,400 BTC—worth roughly $268 million—back to the Liquid Federation wallet on Monday. About 600 BTC, or around 15% of the amount withdrawn, remains in the attacker's possession. Whether that balance is being kept as a bounty remains unclear, as no public agreement has been disclosed. The partial recovery follows the attacker's pledge to return most funds after Blockstream fixed the underlying software flaw. In messages to Blockstream, the attacker asked for all nodes to be patched before any bitcoin was sent back. Blockstream later said its bridge nodes had been patched and were safe to receive the returned funds. Liquid said the incident—disclosed Sept. 6—did not involve compromised private keys, and SideSwap said its systems were not breached. The issue is believed to stem from Elements, Liquid's Bitcoin Core fork: a bug in the rangeproof verification cache may have allowed the creation of LBTC without the usual bitcoin backing. Those unbacked tokens were then used to pull real BTC from Liquid's reserves via the standard peg-out process. Liquid has not yet resumed normal operations while operators work toward a safe restart. LBTC deposits and withdrawals remain paused, while other Liquid-issued assets and the underlying Bitcoin network continue operating normally.