Liquid Network Recovers 3,400 BTC From Hackers as $47M Remains Outstanding

Liquid Network has recovered most of the Bitcoin drained in Sunday’s $320 million exploit, but nearly $47 million worth of BTC remains with the attackers.

The network has received 3,400 of the roughly 4,000 BTC withdrawn from its federation wallet, according to updates shared by Samson Mow. About 598 BTC, worth approximately $47 million, remains outstanding.

The attackers have identified themselves as white-hat hackers and had previously indicated that they would return the funds after Liquid fixed the underlying vulnerability.

Liquid Recovers Most of the Stolen Bitcoin

The recovery follows one of the largest Bitcoin related security incidents of the year.

As reported in our earlier coverage of the Liquid Network exploit, attackers withdrew roughly 4,000 BTC worth $320 million from the federation wallet backing Liquid’s L-BTC.

The wallet held around 4,200 BTC before the incident, leaving just 197 BTC after the withdrawal.

Because Liquid's L-BTC is designed to be backed one-for-one by Bitcoin held in the federation wallet, the exploit created an immediate collateral shortfall.

Liquid responded by disabling bridge nodes, pausing network activity and asking exchanges to freeze L-BTC deposits and withdrawals.

Other assets issued on Liquid, including Tether, were not affected.

Related: Bitcoin Network Used by Exchanges Hit by $320M Exploit

Hackers Return 3,400 BTC

The attackers later returned 3,400 BTC to the Liquid federation wallet after the network patched the affected bridge nodes.

Mow said Monday that discussions with the group are continuing over the remaining funds.

“Approximately 598 BTC remains outstanding, and Blockstream continues to engage with the white-hat hackers.”

The remaining Bitcoin is worth roughly $47 million based on the figures provided by Liquid.

The recovery significantly reduces the immediate backing shortfall, but the network still needs to complete its security and operational work before reopening.

Liquid Network Remains Paused

Liquid is a Bitcoin sidechain developed by Blockstream and supported by a federation of crypto companies, including exchanges and miners.

The network is designed to provide faster and more private Bitcoin settlement, with L-BTC representing Bitcoin locked in the federation wallet.

Following the exploit, Liquid operators have kept the network paused while they work through several issues.

These include:

• Completing additional security fixes
• Resolving a chain split created during the incident
• Restoring the federation infrastructure
• Ensuring L-BTC is properly backed before restarting

Mow also warned users not to send Bitcoin to Liquid peg-in addresses until the network officially confirms that it has restarted.

A Different Outcome for a Major Crypto Hack

The return of most of the stolen Bitcoin distinguishes the Liquid incident from many other major crypto exploits, where attackers attempt to move or launder funds after draining a protocol.

The incident also highlights the security risks surrounding infrastructure built around Bitcoin rather than the Bitcoin blockchain itself.

Recent attacks have increasingly targeted wallets, applications, bridges and other services connected to digital assets. Altcoin Buzz recently reported that 50 major crypto hacks caused $136.3 million in losses during August, while separate attacks have targeted Bitcoin-related infrastructure and wallets.

Liquid's recovery therefore offers some relief, but it does not eliminate the underlying security concerns.

What Happens Next?

Liquid now faces a more important task than simply recovering the remaining Bitcoin.

The network must demonstrate that the vulnerability has been fully addressed and that the federation infrastructure is secure enough to resume operations.

Operators also need to resolve the chain split and restore confidence that L-BTC is once again fully backed.

Until those steps are completed, the network is expected to remain paused.

The recovery of 3,400 BTC is a major step forward, but the remaining 598 BTC and the broader security investigation mean the Liquid incident is not over yet.