85% of Stolen BTC Returned by Liquid Bridge Attackers

On Monday, the hackers behind the Liquid attack returned 3,400 Bitcoin, most of the roughly 3,998 BTC they had moved out of the network over the weekend. About 598 BTC remains unreturned.

Liquid is a Bitcoin sidechain developed by Blockstream. Users lock BTC on the main network and receive L-BTC, a token that enables faster and more private transactions.

Blockstream Fixed the Bridge Prior to the Fund Return

The transfer occurred after the attackers imposed a condition: Blockstream must patch the vulnerability and confirm that all bridge-running nodes were updated.

Normally, moving Bitcoin out of the bridge requires approval from 11 of the 15 companies operating Liquid. Over the weekend, the funds instead went to a brand-new address.

Blockstream responded via a Bitcoin transaction on Monday morning, signing a message that let recipients verify its authenticity. The company stated that the bridge nodes had been patched and it was safe to return the funds.

The coins were transferred a few hours later. Bitcoin's blockchain recorded the transaction in block 965,950 at 19:09 UTC.

Around 600 Bitcoin Remains in Hackers' Possession

About 598.5 BTC, worth roughly $47 million at Monday's Bitcoin price near $79,100, is still in the attackers' wallet. Neither side has explained why.

Charles Guillemet, chief technology officer at hardware wallet maker Ledger, is troubled by that silence. He had already questioned the white hat label the previous day.

So, 3,400 BTC were refunded. The “white hats” still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!
Let's see what happens to these 600 BTC… https://t.co/nb1p9COmBk pic.twitter.com/BBKLrMVsqd

— Charles Guillemet (@P3b7_) September 7, 2026

On Sunday, BeInCrypto reported that Liquid's peg remained balanced after the outflow and interpreted the attackers' notes as the opening of a negotiation rather than a theft. That call proved close.

Blockstream shut off the bridge and asked exchanges to freeze L-BTC deposits and withdrawals. It has not said when service will resume or how it will cover the shortfall left by the missing coins.