In the latest Bitcoin news, the white hackers behind the withdrawal of roughly 4,000 BTC from the Liquid Network returned 3,400 BTC, worth approximately $269.2 million, to the sidechain’s federation wallet, recovering about 85% of the funds.
Approximately 598.5 BTC, worth roughly $47 million, remains in an address linked to the withdrawal, and Liquid has not said when its peg services will resume or how the shortfall will be handled.
This is not simply a recovered exploit. It is a partial resolution that leaves a sidechain’s backing, custody status, and operational timeline all unresolved at once.
The remaining 598.5 BTC sits in an address tied to the incident rather than a wallet confirmed lost. Liquid has not announced whether that Bitcoin will be returned, how it will cover any resulting gap in L-BTC backing, or when normal side-chain and peg operations will resume.
Update: 3,400 BTC of the roughly 4,000 BTC withdrawn on September 6 has been returned to the @Liquid_BTC Federation wallet. The return followed confirmation from @Blockstream that the affected bridge nodes have been patched. Approximately 598 BTC remains outstanding, and…
— Samson Mow (@Excellion) September 7, 2026
DISCOVER: Trade Crypto On Binance
Liquid Bitcoin Hack: How the Withdrawal and Return Unfolded
The incident began Sunday when a customer sent 4,000 L-BTC to SideSwap’s peg-out service, triggering the abnormal withdrawal from the federation reserve. Liquid responded by disabling its bridge nodes and asking exchanges to suspend L-BTC deposits and withdrawals while it assessed the damage, a containment step similar to the halted-service response seen in other recent exploit cases where networks froze operations mid-incident.
The actors identified themselves as “whitehats” in an on-chain Bitcoin transaction message and said the chain remained at risk until every node was patched. The return followed a subsequent exchange of messages conducted through Bitcoin transactions between the actors and Blockstream, the developer of the Liquid sidechain, which culminated in a signed message from Blockstream confirming that bridge nodes were patched and safe.
The actors then transferred 3,400 BTC to the Liquid Federation address, having previously offered to return “most” of the Bitcoin without explaining why they retained the rest.
Liquid Network recovered 3,400 BTC
DISCOVER: Meme coin supercycle: Top performers this week
Bitcoin News Today: Liquid’s $47M Question – Recovered Funds But Unresolved Trust
Hacker Message
This latest Bitcoin news reopens long-standing security concerns in crypto. Liquid operates as a side-chain secured by a federation wallet and a set of bridge nodes, both of which were taken offline once the abnormal withdrawal was detected. L-BTC deposits and withdrawals remain suspended, and the network has given no public timeline for restoring normal service, leaving users unable to move assets through the peg in the interim – a reminder of how difficult full accounting becomes after a large-scale Bitcoin hack disrupts a live settlement layer.
Ledger Chief Technology Officer Charles Guillemet publicly questioned the white-hat framing after most of the funds were returned, characterizing the retention of roughly 600 BTC as inconsistent with a genuine bug-bounty arrangement and describing it as closer to extortion than white-hat hacking. His skepticism echoes broader unease in the industry about how attacker-controlled funds get labeled after the fact, a pattern also visible in prior incidents where large Bitcoin sums were stolen from numerous addresses before any resolution was reached.
Liquid has not said whether the remaining coins will be returned, how any gap in L-BTC backing will be covered, or when the sidechain and its peg services will resume normal operations.
EXPLORE: Crypto breakout alerts this week
Sign Up With MEXC To Unlock 0% Trading Fees This Bullrun
Disclaimer: Coinspeaker is committed to providing unbiased and transparent reporting. This article aims to deliver accurate and timely information but should not be taken as financial or investment advice. Since market conditions can change rapidly, we encourage you to verify information on your own and consult with a professional before making any decisions based on this content.
Daniel Frances is a technical writer and Web3 educator specializing in macroeconomics and DeFi mechanics. A crypto native since 2017, Daniel leverages his background in on-chain analytics to author evidence-based reports and deep-dive guides. He holds certifications from The Blockchain Council, and is dedicated to providing “information gain” that cuts through market hype to find real-world blockchain utility.