Catenaa, September 07, 2026- An attacker returned 3,400 bitcoin to Liquid Network after Blockstream patched its bridge nodes, recovering 85% of funds withdrawn Sunday.
About 598.5 bitcoin, worth $47.3 million, remained in the attacker’s wallet after the repayment.
The party had withdrawn nearly 4,000 bitcoin, then valued around $320 million, from Liquid’s federation wallet through an unauthorized peg-out.
The attacker communicated with Blockstream through Bitcoin OP_RETURN messages and encrypted text, demanding every affected node be patched before returning funds.
Blockstream later sent a signed onchain message confirming its bridge nodes had been repaired and the bitcoin could be returned safely.
The attacker then transferred 3,400 bitcoin to the federation address. Neither party has disclosed whether the retained bitcoin represents an agreed reward.
The incident began when 4,000 L-BTC were submitted to SideSwap’s peg-out service and burned through a valid authorization process.
The Liquid Federation consequently released about 3,996 bitcoin to an address controlled by the attacker.
SideSwap said its systems and authorization credential were not compromised.
Blockstream traced the incident to a bug in Elements, the software supporting Liquid, which allowed the creation of unbacked L-BTC.
Liquid paused its network, disabled bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals while developers investigated.
SideSwap said swaps, peg-ins and peg-outs would remain unavailable until the network resumes.
The return reduces Liquid’s immediate financial exposure, but the unexplained retention of nearly 600 bitcoin leaves questions about the attacker’s white-hat claim.
Liquid has not announced when network operations will restart.
