Liquid recovers 3,400 BTC as hacker asks “is that ok?” after pocketing $47 million in Bitcoin

Bitcoin's Liquid sidechain received 3,400 BTC back into its federation wallet on Sept. 7 after a reserve drain. The partial recovery restores assets behind L-BTC, its Bitcoin-linked token, while withdrawal access remains unconfirmed and public bridge nodes are still listed as experiencing a major outage.

The recovery transaction confirmed at 16:09:25 UTC in Bitcoin block 965950. By press time on Sept. 8, Blockstream’s status page still listed an active Liquid security incident and a major outage affecting public bridge nodes.

That leaves holders with two separate questions: how much Bitcoin is available to back their tokens, and when they can redeem them.

Before the repayment, the self-described white-hat hackers wrote in an on-chain message that they were “sending most back” to Liquid’s federation address, asking “is that ok.”

The subsequent transaction returned 3,400 BTC to the federation wallet and sent approximately 598.5 BTC, worth roughly $47 million at the time, back to the hackers’ address. The public evidence reviewed does not establish that this retained amount was an agreed bounty.

CryptoSlate’s earlier coverage put the original federation outflow at approximately 3,996 BTC. The later recovery transaction spent approximately 3,998.5 BTC from the holder address.

The return followed another on-chain patch message at 09:41:26 UTC on Sept. 7, stating that bridge nodes had been patched and that funds were safe to return. This reconstruction reports that its signature verifies against Blockstream’s security key. The patch claim does not establish that withdrawal services had reopened.

The remaining test for holders

Liquid’s documented redemption process burns L-BTC and releases Bitcoin through the federation. Ordinary users generally need an authorized member or service to convert their L-BTC back to BTC.

The returned coins add assets to the backing wallet. Establishing full backing requires reconciling recoverable reserves with legitimate outstanding L-BTC. The 3,400 BTC transfer alone does not supply that accounting.

Operational access also depends on services reopening. In its Sept. 6 incident statement, @Liquid_BTC said bridge nodes had been disabled and exchanges had paused or would pause L-BTC deposits and withdrawals.

That day, @side_swap said its swaps, peg-ins and peg-outs were paused until Liquid resumed. It asked users not to send new peg-in or peg-out deposits until it announced services were back.

Exchange withdrawal access still requires confirmation from individual services. With Blockstream’s dashboard listing the bridge outage on Sept. 8, a confirmed restart and a reserve reconciliation remain the next tests of whether holders can convert their L-BTC back to Bitcoin in full.

Approximately 598.5 BTC remained at the hackers’ address at press time.