Liquid Network Recovers 3,400 BTC; 598 BTC Still Unaccounted for After Security Incident

Liquid Network, a Bitcoin Layer 2, has recovered 3,400 BTC of the roughly 4,000 BTC withdrawn during Sunday's security incident, according to an update from Samson Mow. The individuals claiming to be whitehat hackers had told Blockstream-backed Liquid that the bitcoin would be returned once the network issue was fixed, warning the chain remained at risk and urging Blockstream to patch every node before transferring funds back. Blockstream said the BTC was returned after it confirmed the affected bridge nodes had been patched. About 598 BTC remains outstanding, and Blockstream continues to engage with the parties behind the whitehat claim. The recovery follows Liquid's disclosure that around $320 million worth of BTC was withdrawn from its Federation wallet. The funds were moved using the SideSwap PAK, while Liquid said the Pegout Authorization Key itself was not compromised. In response, exchanges paused or prepared to pause LBTC deposits and withdrawals. Liquid disabled its bridge nodes, effectively halting the sidechain. Liquid remains paused as Blockstream and Federation members roll out additional fixes and security upgrades, work to resolve a chain split, and prepare for a coordinated restart. Wallets and related services are still impacted. Mow also warned users not to send bitcoin to Liquid pegin addresses until the network confirms it has restarted. "Following the recent incident affecting the Liquid Network and the movement of funds, Blockstream, as Liquid's technical provider, and the Liquid Federation have been working diligently to resolve the ongoing situation and ensure the return of assets," the statement said. "Updated software has been deployed as the Federation members prepare the network for a coordinated restart. Our teams remain focused on further hardening the network." Community reaction has been sharp. Ledger CTO Charles Guillemet questioned whether the remaining BTC could reflect a negotiated reward tied to an encrypted contract signed onchain, arguing that would look closer to extortion than conventional whitehat hacking. Bitcoin Rails podcast host Isabel Foxen Duke also criticized the whitehat hackers' actions, calling the situation "insanely illegal/unethical" and warning that serious consequences could follow if those involved are identified. One market commentator labeled the Liquid incident "the most embarrassing moment in Bitcoin's modern history."