Liquid Network Restarts Operations as Hack Recovery Reaches Final Phase

More than a month after attackers took 4,000 bitcoin (worth approximately $320 million at the time) from the Liquid Network's federation wallet and returned most of it in what was described as a white-hat operation, the network announced on Tuesday that its services were fully functional again.

In a blog post, the Liquid Network reported that it was entering "the final stages of recovery with enhanced security."

The 4,000 bitcoin were taken from the federation wallet backing the Blockstream sidechain in September. Blockstream managed to retrieve the majority of the funds through negotiation.

LBTC:BTC swaps full service again. swap @liquid_btc to/from mainchain BTC on @side_swap. swap @liquid_btc to/from lightning on @AquaBitcoin. https://t.co/csslFIIRAE

— Adam Back (@adam3us) October 20, 2026

"The final phase of restoration involves reestablishing the network’s full 1:1 bitcoin backing, followed by the controlled reactivation of Federation peg-outs for authorized PAK key holders," the Liquid blog post explained.

"The Federation, Blockstream, and independent security experts have made substantial progress toward this objective, with the necessary technical infrastructure and safeguards now in place."

The blog also said that phased swaps had been brought back online. Blockstream CEO Adam Back wrote on X on Tuesday that the swap service was operational.

Blockstream's Liquid is a layer-2 protocol that enables the transfer of assets fully backed by bitcoin. Applications that support Liquid allow users to exchange stablecoins for bitcoin as well as bitcoin for lightning network bitcoin.

The attackers obtained 4,000 bitcoin by exploiting an inflation vulnerability in the Liquid sidechain, minting more than 4,000 LBTC tokens — supposed to be bitcoin-backed — that were counterfeit and then converting them to genuine on-chain bitcoin.

The individuals claimed to be white-hat hackers and communicated with Blockstream by embedding messages in Bitcoin blocks. Nevertheless, critics have questioned their white-hat status because they retained 15% of the stolen funds, worth millions of dollars.

In one message, the hackers called Blockstream "delusional, greedy, and arrogant" and vowed to disclose the company's encrypted communications unless Blockstream paid them 10% of the bitcoin as an official bounty.

"You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess," the message read.

According to the latest publicly known information, around 600 bitcoin — 15% of the total — remain in the hackers' possession, valued at approximately $50 million at current prices.

Whether Blockstream agreed to a private settlement with the hackers is not known.