Liquid Recovers 3,400 Bitcoin but Remains Offline
The return of 85% of the withdrawn reserve eases Liquid’s collateral crisis, but 598 BTC remains outstanding and the sidechain has not restarted.
Liquid Network has recovered 3,400 of the roughly 4,000 bitcoin withdrawn from its federation wallet during Sunday’s security incident, materially reducing the potential loss but leaving the Bitcoin sidechain offline. About 598 BTC, worth approximately $47 million at the time of the update, remains outstanding.
The return changes the immediate financial picture. Sunday’s withdrawal was valued at about $320 million and removed almost the entire reserve backing Liquid Bitcoin, or L-BTC. Before the incident the federation wallet reportedly held roughly 4,200 BTC; only about 197 BTC remained after the withdrawal. Because each L-BTC is intended to be backed one-for-one by bitcoin held by the federation, the reserve shortfall struck at the core of the sidechain’s promise.
The people behind the withdrawal have been described as white-hat hackers, but their identity and motivation have not been independently verified. They communicated through messages embedded in Bitcoin transactions and returned 3,400 BTC after Blockstream said affected bridge nodes had been patched. The continued retention of nearly 600 BTC means the description should remain provisional rather than being treated as established fact.
Samson Mow, a former Blockstream executive who has published incident updates, said Blockstream continues to engage with the group. He also said Liquid remains paused while Blockstream and federation members make further security improvements, resolve a chain split and prepare a safe restart. Users have been told that no action is required and not to send bitcoin to Liquid peg-in addresses until the network is confirmed live again.
The network pause limits further operational risk, but it also prevents normal settlement. Liquid is used by exchanges, trading firms and other crypto companies as a faster and more private Bitcoin settlement layer. Assets issued on Liquid, including tether, were reported as unaffected, although holders and venues still depend on the network’s orderly recovery and on reliable access to the bitcoin bridge.
Recovering most of the reserve does not by itself restore full backing. Operators must account for the remaining bitcoin, reconcile the chain split and demonstrate that the vulnerability has been closed. They also need to show that federation controls can withstand a similar failure without relying on the voluntary return of funds.
The episode exposes the trade-off in federated sidechains. Liquid can offer faster confidential transfers because a defined group of functionaries manages the connection to Bitcoin. That model avoids a single corporate custodian, but it creates a concentrated operational and governance layer. If bridge credentials or signing controls fail, the assets backing the representation on the sidechain can be put at risk even though the Bitcoin base chain continues operating normally.
The recovery therefore shifts the central question from the size of the loss to the adequacy of the repair. A post-incident explanation should identify the compromised component, the conditions that allowed such a large withdrawal, the safeguards added and the process for making users whole if the remaining 598 BTC is not returned. Independent technical review would carry more weight than assurances from the same parties responsible for the system.
Why it matters
Returning 85% of the withdrawn bitcoin sharply reduces the worst-case collateral deficit and makes an orderly restart more plausible. It is genuinely new information relative to the initial incident: the network is no longer facing the same potential $320 million hole reported on Sunday.
Yet the sidechain remains unavailable, the reserve is not fully restored and the white-hat account is unverified. For L-BTC holders, exchanges and institutions using Liquid, access and confidence depend on more than recovered funds. They need clear evidence of backing, a consistent chain state and bridge controls that cannot be bypassed in the same way.
The eventual incident report will be the decisive document. Until it explains the failure and the remaining exposure, the recovered bitcoin should be understood as risk reduction—not resolution. A safe restart also requires operational discipline: no new peg-ins before confirmation, coordinated support among exchanges and transparent accounting for every reserve movement.