Update (Sep 7): Purported white-hat actors who drained roughly 4,000 BTC (~$320 million at the time) from Blockstream’s Liquid Network federation wallet have returned exactly 3,400 BTC after a day of on-chain talks. They kept about 598.5 BTC — roughly 15%, or ~$47–48 million — as an implied bounty with no published agreed deal. Liquid remains paused while operators work on reserve and backing restoration. This is the return chapter, distinct from Sunday’s withdrawal story.
If you caught our earlier coverage of the ~4,000 BTC federation-wallet drawdown, treat this as the Monday follow-through: most of the bitcoin came back, a large remainder did not, and the sidechain is still frozen.
What Happened on Sep 6 (Quick Recap)
On Sunday, Sep 6, about 4,000 BTC left the Liquid federation wallet that backs L-BTC. Reporting put the wallet near ~4,200 BTC beforehand — roughly a 95% drain. Liquid disabled bridge nodes. Exchanges halted or prepared to halt L-BTC deposits and withdrawals. Other Liquid-issued assets such as USDT, DePix, and RWAs were reported unaffected. Bitcoin’s mainnet was unaffected.
Cointelegraph, Decrypt, and The Business Times framed the pause and the dollar size. Liquid and SideSwap messaging, as covered across those outlets and later digests, stressed a critical distinction: no federation keys and no SideSwap keys were compromised. The peg-out ran through SideSwap’s valid Peg-out Authorization Key (PAK) path. The L-BTC creation angle pointed at an Elements software bug — not stolen custody keys.
Actors labeled themselves white hats via Bitcoin OP_RETURN messages and asked to be contacted on-chain. That self-label is unverified; Liquid’s own language stayed in “purported white-hat” territory.
On-Chain Talks, Then a Conditional Return
What followed was unusually public for a nine-figure incident. According to Bitcoin Magazine’s Sep 7 report, Blockstream-linked addresses answered on-chain, including a prompt to contact [email protected], plus Electrum-encrypted payloads and PGP signatures checkable against Blockstream’s published security key.
Clear-text notes in the trail asked whether sending “most” of the coins back to the federation script was acceptable, then conditioned any return on a network-wide patch: fix the bug first, confirm every node is patched, then move funds safely. Blockstream later signaled that bridge nodes were patched and that it was safe to return the funds.
CryptoSlate covered the same pressure dynamic earlier in the arc: coins held until developers could show a fatal flaw was patched. Treat that as sourced context for the negotiation posture — not proof of motive, ethics, or a closed legal chapter.
Sep 7 ~16:09 UTC: Exactly 3,400 BTC Comes Back
Bitcoin Magazine cites a return transaction (id prefix bc49a46d) confirmed around 16:09 UTC on Sep 7 that sent exactly 3,400 BTC to the labeled Liquid peg / federation address. The actors’ address retained about 598.5 BTC as change — roughly 15% of the consolidated pile, worth on the order of $47–48 million in contemporaneous coverage (Bitcoin.com puts the kept stack near $47 million; Bitcoin Magazine’s round number lands near $48 million).
Bitcoin.com underscores two points that matter for readers: (1) nothing in the published on-chain messages identified that remainder as an agreed bounty, and (2) Liquid stayed paused after the return while operators still needed to restore credible 1:1 backing for legitimate L-BTC and keep patched Elements software distributed.
Encrypted follow-ups after the return, as Bitcoin Magazine reconstructs them, suggest Blockstream was unhappy about the size of the implied finder’s fee. Public clear-text then thinned out; one reported emoji reply from the actors side does not unlock the encrypted payloads. Do not invent what those messages said, and do not invent a signed bounty contract that outlets say was never published.
What Is Still Frozen — and What Is Not
As of the Sep 7 return coverage:
- Liquid remains paused — bridge nodes disabled; the network is not “back to normal” just because 3,400 BTC landed.
- L-BTC deposit/withdrawal rails at exchanges remain halted or treated as halted operational context until issuers and operators say otherwise.
- Other Liquid-issued assets (USDT, DePix, RWAs) were still described as unaffected by the original incident messaging.
- Bitcoin mainnet was never the failure domain here.
The return takes pressure off the worst reserve hole, but it does not automatically reopen peg trust. Operators still have to show that remaining L-BTC is backed, that the Elements flaw class is patched network-wide, and that reopening the bridge will not recreate the same issuance-then-peg-out path. No public restart timeline is confirmed in the sources above — so none is invented here.
Why the “Not Stolen Keys” Framing Still Matters
Classic hot-wallet narratives are easy: a key leaks, coins leave, postmortem is custody. Liquid’s sourced framing is harder. Federation and SideSwap keys were said not compromised. A peg-out looked valid under SideSwap’s PAK path. The economic failure sat earlier — L-BTC tied to an Elements bug that let unbacked (or wrongly created) L-BTC enter a path that federation machinery then honored with real mainchain bitcoin.
That is why “white hat returned most of it” is not the full story, and why “Liquid is fixed because 3,400 BTC came back” is also incomplete. Peg products inherit software risk. Federated signers can behave as designed and still pay out a lie the consensus layer accepted.
What to Watch Next (No Fan Fiction)
- Official Liquid / Blockstream status on bridge reopen criteria and any new public statement beyond Sunday’s pause messaging.
- Reserve / backing proof after the 3,400 BTC return — whether federation balances restore a credible peg picture for remaining L-BTC.
- Elements patch distribution — “bridge nodes patched” is a signal, not a full network postmortem.
- The ~598.5 BTC remainder — still under the actors’ control in reporting, with no published agreed bounty terms.
- Exchange and wallet L-BTC rail status — operational only; not a trading cue.
The Jamoraquai Take
Returning 3,400 BTC after on-chain PGP theater is a better headline than “$320M gone forever.” It is not a clean ending. Purported white hats kept roughly one-sixth of a nine-figure pile with no published bounty agreement, Liquid is still paused, and the core failure class — Elements creating an economic state the peg then paid — is exactly the kind of bug that federated sidechains cannot shrug off with a press-friendly recovery narrative.
Credit where coverage is due: negotiation conditioned on a patch, Blockstream signaling bridge nodes were safe for a return, and most coins landing back at the federation address are material facts. So is the retained ~598.5 BTC. Until Liquid restores rails with believable backing and a clear patch story, treat L-BTC as an impaired peg product — alleged white-hat branding included. This is news context, not financial advice: no buy, sell, or hold recommendation is implied.
