Liquid Network recovers 3,400 BTC after bridge node patch

Liquid Network developments now center on a confirmed change: purported white-hat hackers returned 3,400 bitcoin to the Liquid federation wallet after Blockstream patched its bridge nodes, leaving roughly 598.5 BTC outstanding. This development affects exchanges that paused LBTC deposits and withdrawals, along with any user holding or moving Liquid bitcoin, and the operating impact matters because the network is preparing to restart after a security incident that temporarily halted core workflows.

What the confirmed return means for Liquid

According to CoinDesk, the supposed white-hat hackers behind Sunday’s Liquid Network breach returned 3,400 of the 4,000 BTC they took, but nearly $47 million in bitcoin is still outstanding. Cointelegraph reported that the actors returned 85% of the Bitcoin withdrawn from Liquid’s federation wallet following the security incident, and that the network is preparing to restart. Decrypt added that nearly 600 BTC remains outstanding after Blockstream told the actors in an on-chain message that Liquid’s bridge nodes had been patched.

The Block specified that the attacker returned 3,400 BTC after the bug fix, retaining about 598.5 BTC.

These four independent publisher domains converge on the same confirmed change: the return of 3,400 BTC, the patch of bridge nodes, and the remaining balance of roughly 598.5 BTC. The return is a concrete, dated development that changes the operating picture for Liquid, which had been paused after the initial withdrawal of $320 million in bitcoin. The affected participants include Blockstream, the Liquid federation, exchanges that suspended LBTC deposits and withdrawals, and users who rely on the sidechain for faster bitcoin settlement.

Who is affected by the Liquid Network developments

The confirmed change directly affects exchanges that had paused LBTC deposits and withdrawals when the network was halted. The Block reported that the Bitcoin sidechain was paused, with exchanges suspending LBTC deposits and withdrawals as Blockstream worked to contact those responsible.

That pause disrupted the workflow of moving bitcoin onto Liquid for trading or issuance, and the return of 3,400 BTC is a step toward restoring normal operations, but the remaining 598.5 BTC still creates uncertainty for users and venues that need full confidence in the network's security.

For participants, the operating impact is clear: the bridge node patch reduces the immediate exploit risk, and the return of most of the withdrawn bitcoin reduces the potential loss to the federation. However, the outstanding balance means that not all funds are accounted for, and the network restart depends on resolving that gap.

The honest read is that the confirmed change is positive for operational continuity, but it does not eliminate the need for users and exchanges to verify that the network is fully secure before resuming activity.

Why the bridge node patch matters for network security

The bridge node patch is the mechanism that enabled the return, according to Decrypt and The Block. Blockstream told the actors in an on-chain message that the bridge nodes had been patched, which likely closed the vulnerability used in the initial withdrawal. This is a technical development that affects the network's security posture, and it is the reason the actors returned most of the bitcoin.

Without the patch, the return might not have happened, and the network would face a higher risk of further exploits.

The patch is a confirmed change, but the details of the bug and the exact patch implementation are not fully disclosed in the supplied sources. That means the operating impact is real, but the technical specifics remain to be verified. For users, the practical check is to confirm that the network has fully restarted and that exchanges have resumed LBTC deposits and withdrawals, which would signal that the patch has been validated in production.

What still needs confirmation in the source documents

While the return of 3,400 BTC is confirmed across four sources, several details still require a source-document check. The exact percentage returned varies by source: Cointelegraph says 85%, while CoinDesk and The Block specify 3,400 of 4,000 BTC. The remaining balance is reported as nearly 600 BTC by Decrypt and 598.5 BTC by The Block, a slight discrepancy that needs resolution.

Additionally, the status of talks for the remaining bitcoin, as noted by CoinDesk, is not detailed in the other sources, so the outcome of those discussions remains unresolved.

The next check is to review the original statements from Blockstream and the actors to confirm the exact return amount, the remaining balance, and any conditions attached to the return. This is a source-document check that would clarify whether the return was unconditional or tied to the patch, and whether the remaining 598.5 BTC will be returned or retained.

Until then, the confirmed change is the return of 3,400 BTC and the bridge node patch, but the full resolution of the incident is still pending.

Reference

• https://www.coindesk.com/markets/2026/09/08/white-hat-hackers-return-most-of-usd320m-bitcoin-taken-from-liquid-network
• https://cointelegraph.com/news/liquid-white-hats-return-270m-bitcoin-network-restart
• https://decrypt.co/377600/liquid-hackers-return-270m-bitcoin
• https://www.theblock.co/news/defi/2026-09-07-liquid-network-attacker-says-they-will-return-most-of-4000-btc-after-bug-fix-413673
• https://www.theblock.co/news/defi/2026-09-06-liquid-network-pauses-after-purported-white-hat-hackers-withdraw-320-million-in-bitcoin-413626