Liquid recovers 3,400 BTC after hack return, with about $47M still in hacker wallet

Liquid, Bitcoin's sidechain, received 3,400 BTC back into its federation wallet on Sept. 7 following a reserve drain, partially restoring the backing for its Bitcoin-linked token, LBTC. The recovery transaction was confirmed at 16:09:25 UTC in Bitcoin block 965950. As of press time on Sept. 8, Blockstream's status page continued to show an active Liquid security incident and a major outage affecting public bridge nodes. Withdrawal availability also remained unconfirmed, leaving LBTC holders focused on two issues: how much BTC is still available to back the token supply, and when redemptions will resume. Prior to the repayment, self-described whitehat hackers posted an on-chain message saying they were "sending most back" to Liquid's federation address and asking, "is that ok". The subsequent transaction returned 3,400 BTC to the federation wallet and routed about 598.5 BTC back to the hackers' address, worth roughly $47 million at the time. Available public evidence does not show that the retained amount was an agreed bounty. CryptoSlate previously estimated the initial outflow from the federation at about 3,996 BTC. The later recovery transaction spent roughly 3,998.5 BTC from the holder address. The return came after another on-chain message at 09:41:26 UTC on Sept. 7 claiming bridge nodes had been patched and that funds were safe to return. This reconstruction reports the signature verifies against Blockstream's security key. The patch claim, however, does not confirm that withdrawal services had reopened. What holders still need to see Liquid's documented redemption process burns LBTC and releases BTC via the federation. In practice, most users rely on an authorized member or service to convert LBTC back to BTC. While the returned coins increase assets in the backing wallet, full backing requires reconciling recoverable reserves against legitimate outstanding LBTC, and the 3,400 BTC transfer alone does not provide that accounting. Operational access also hinges on services coming back online. In a Sept. 6 incident statement, @Liquid_BTC said bridge nodes had been disabled and exchanges had paused, or would pause, LBTC deposits and withdrawals. The same day, @side_swap said swaps, peg-ins, and peg-outs were paused until Liquid resumed and urged users not to send new peg-in or peg-out deposits until services restarted. With Blockstream's dashboard still listing a bridge outage on Sept. 8, markets are watching for confirmation of a restart and a clear reserve reconciliation to determine whether holders can redeem LBTC for BTC in full. About 598.5 BTC remained at the hackers' address at press time.