Liquid Network recovered 3,400 BTC from a security incident but 598 BTC remains missing; network stays paused while Blockstream implements security fixes.
Security & Exploits ·
Liquid Network has recovered 3,400 of the approximately 4,000 BTC that were withdrawn during a Sunday security incident, according to an update from Samson Mow. The parties claiming to be white-hat hackers had conditioned the return on Blockstream patching affected bridge nodes—a condition the company confirmed it met. However, around 598 BTC remains unaccounted for, and Blockstream continues to communicate with those holding the outstanding funds.
The sidechain remains offline as Blockstream and Liquid Federation members work through additional hardening measures, address a chain split, and coordinate a restart. Users have been advised to avoid sending Bitcoin to Liquid peg-in addresses until operations resume. The incident involved unauthorized access to the SideSwap Peg-out Authorization Key, which enabled the initial movement of funds from the Federation wallet, though the key itself was not compromised.
Community skepticism has surfaced around the white-hat narrative. Charles Guillemet, Ledger's CTO, suggested the retained 598 BTC could signal a negotiated ransom paid through an on-chain signed contract, framing the scenario as extortion rather than legitimate security research. Others, including Isabel Foxen Duke, have characterized the actions as illegal and unethical, noting potential legal exposure if the parties are identified. What remains unclear is whether the 598 BTC will ultimately be returned and on what timeline the network will resume normal operations.