breaking-news · bitcoin · security · sidechains · infrastructure
Liquid Actors Return 3,400 BTC After Reserve Exploit
About 85% of the bitcoin removed from Liquid's federation reserves has returned, but approximately 598.5 BTC remains with the actors and the final terms are not independently established.
The actors behind the withdrawal of nearly 4,000 BTC from Liquid Network's federation reserves returned exactly 3,400 BTC on September 7, materially changing the initial incident assessment.
The return transaction was confirmed on Bitcoin and sent the funds to a Liquid federation peg address. Approximately 598.5 BTC remained in the actors' address after the transfer.
The partial recovery followed onchain messages between the self-described white hats and Blockstream. Blockstream had said bridge nodes were patched and that the funds could be returned. Reporting describes the retained balance as part of a disclosed arrangement or implied reward, but no independently verified signed agreement establishing final ownership of the 598.5 BTC has been published.
The underlying mechanism remains unchanged from the first report. SideSwap said unbacked L-BTC was created through an Elements software bug and then passed through a valid peg-out; it said neither its systems nor its authorization key was compromised. Bitcoin's base layer was not compromised.
Returning most of the reserve reduces the immediate backing deficit but does not close the incident. The remaining questions include the legal and governance basis for the retained amount, the complete root cause, the patch's independent review, reconciliation across federation members and the conditions for normal network operation.
The incident is therefore no longer accurately described as nearly 4,000 BTC still outstanding. It is now a partial-recovery case with approximately 15% of the transferred balance unresolved.
Sources and disclosures
Sources: confirmed Bitcoin transaction reporting; Blockstream/Liquid and SideSwap statements; Unchained, Bitcoin Magazine and The Block contemporaneous coverage. “White hat” remains self-described. The retained balance is not characterized as an authorized bounty without primary documentation.
Update note
Revision r2 candidate, observed September 8, 2026 BRT. Confirm current network status, the exact retained balance and any official agreement or post-mortem immediately before publication.