Liquid Network has recovered most of the Bitcoin drained during a weekend exploit. Onchain data shows that the self-claimed white-hat hacker on Monday returned 3,400 BTC worth about $268 million to the Liquid Federation wallet.
Approximately 600 BTC, equivalent to 15% of the total withdrawn, is still held by the party. It is unclear whether the remaining Bitcoin was kept as a bounty, as no agreement has been made public.
The recovery came after the hacker pledged to return most of the funds once Blockstream patched the underlying software bug. In messages to Blockstream, the hacker requested that every node be patched before sending Bitcoin back.
Blockstream later said its bridge nodes had been patched and were safe for the funds to be returned.
The attack, which was disclosed on Sept. 6, did not involve stolen private keys, according to Liquid, and SideSwap said its own systems were not breached.
Instead, the vulnerability appears to have originated in Elements, the Bitcoin Core fork used by Liquid, where a range-proof verification cache bug apparently enabled the creation of L-BTC without the Bitcoin normally required to back it. Those unbacked tokens were then used to obtain real BTC from Liquid’s reserves through the normal peg-out process.
Liquid has yet to resume operations as its operators work toward a safe restart. L-BTC deposits and withdrawals remain halted, while other Liquid-issued assets and Bitcoin’s underlying network continue to operate without disruption.