The Liquid Network security incident has made phased progress. The address involved in withdrawing approximately 4,000 BTC has returned 3,400 BTC to the federation wallet of this sidechain, equivalent to about $269.2 million at the price cited in the article, accounting for roughly 85% of the funds involved in the incident. However, approximately 598.5 BTC still remain in the address associated with the withdrawal, valued at around $47 million.
The event began with a SideSwap peg-out operation.
The incident occurred on Sunday. A customer sent 4,000 L-BTC to SideSwap’s peg-out service, after which the corresponding amount of BTC was withdrawn. Subsequently, the actors involved, via information attached to a Bitcoin transaction, identified themselves as "white-hat hackers," claiming their actions were intended to expose security vulnerabilities.
After the incident, Liquid shut down the bridge node and requested the exchange to suspend deposits and withdrawals of L-BTC to prevent further risk expansion.
Blockstream signs a message
Before the funds were returned, Blockstream communicated with the relevant addresses via Bitcoin transaction data. As the developer of the Liquid sidechain, Blockstream subsequently issued a signed message stating that the bridge node had been repaired and that it was safe to return the funds.
After this message was sent, the relevant address transferred 3,400 BTC back to the Liquid Federation address. Previously, the party had indicated a willingness to return "most" of the bitcoins but did not publicly explain why the remaining portion was retained.
The destination of nearly 600 BTC remains unclear.
Although most funds have been returned, Liquid still faces several unresolved issues: whether the remaining BTC will continue to be returned, how the L-BTC reserve shortfall will be addressed, and when the sidechain and peg services will resume normal operation.
Ledger’s Chief Technology Officer, Charles Guillemet, expressed skepticism about the “white hat” label. On X, he stated that if this was not a pre-arranged on-chain reward and the other party retained approximately 600 BTC, it resembles coercion more than typical white-hat behavior.
As of publication, Blockstream has not provided further comments to foreign media, and Liquid has not announced a specific timeline for resuming normal operations.