Most of the funds drained from Liquid Network’s reserves have finally returned. A self-proclaimed white-hat hacker sent back 3,400 BTC worth approximately $270 million to the Liquid federation wallet on Monday, September 8, 2026. The return came just a day after the attacker withdrew a total of 4,000 BTC, or $320 million equivalent, from the network’s sidechain reserves on Sunday, September 7.
Although the majority of the assets are back in rightful hands, the ordeal is not entirely resolved. A remaining 598.5 BTC worth $47 million is still stuck in the attacker’s wallet address. As of writing, the perpetrator has provided no explanation as to when the tens of millions of dollars will be returned, or whether the remaining funds will be returned to the federation at all.
On-Chain Messages and the Bug Behind the Scenes
The recovery process for the 3,400 BTC began with a public communication on the blockchain ledger. Blockstream developers sent an on-chain signed message addressed to the hacker. The message was brief and clear: “Bridge nodes are patched, safe to return the funds.” The attacker responded to the message by routing the majority of the stolen funds back to the origin wallet.
Technical tracing revealed that the initial exploit was executed through SideSwap’s peg-out service. Relevant parties confirmed that SideSwap’s keys were neither leaked nor compromised. The root security issue stemmed purely from a bug in the Elements software, which serves as the foundational architecture for Liquid Network’s operations.
Following the discovery of the vulnerability, Blockstream promptly released and deployed an updated software version. Federation members are now preparing to execute a coordinated network restart to ensure the system returns to normal operation with no vulnerabilities remaining.
White Hat or Pure Extortion?
The remaining hundreds of Bitcoin still sitting in the attacker’s wallet have sparked sharp debate over the true motives behind the exploit. Ledger Chief Technology Officer Charles Guillemet openly voiced skepticism regarding the “white hat” label attached to the Liquid network exploit.
“If the retained 600 BTC is a negotiated reward, this looks more like extortion than white hat hacking,” Guillemet said, commenting on the status of the $47 million that has yet to be returned.
Amid uncertainty surrounding the fate of the 598.5 BTC, JAN3 CEO Samson Mow confirmed the return of the 3,400 BTC. He also issued an emergency operational warning to active users. Mow urged the entire community not to send any BTC to Liquid peg-in addresses until the network restart is fully completed and confirmed safe for new transaction traffic.
Incidents of exploits and negotiations like this once again highlight the thin line between good intentions and asset ransom. When recovery deals involve tens of millions of dollars in user funds that may never return, claims of white-hat hacker actions are always accompanied by major question marks.
Reported by Cointelegraph.
Previously: Liquid Network’s 4,000 BTC Drama: Hacker Returns $269M, But Withholds Remaining $47M Without Explanation
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
