Liquid Network recovers 3,400 BTC; peg services remain suspended

3 min

Whitehat actors returned 3,400 BTC to the Liquid Network federation wallet after withdrawing roughly 4,000 BTC. About 85% of funds are back. Approximately 598.5 BTC, worth about $47 million, remains in an address linked to the incident. Liquid has not provided a timeline to restore peg services or detailed how it will address the remaining shortfall.

Liquid Bitcoin Withdrawal and Partial Return

The incident began when a customer sent 4,000 L-BTC to SideSwap’s peg-out service, which triggered an abnormal withdrawal from the federation reserve. Liquid disabled bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals to contain risk. Actors identified themselves as whitehats in an on-chain message and communicated with Blockstream through Bitcoin transactions. After Blockstream confirmed through a signed message that bridge nodes were patched, the actors returned 3,400 BTC to the federation address. They had previously stated they would return most of the Bitcoin and did not explain the retention of the remainder.

Update: 3,400 BTC of the roughly 4,000 BTC withdrawn on September 6 has been returned to the @Liquid_BTC Federation wallet. The return followed confirmation from @Blockstream that the affected bridge nodes have been patched. Approximately 598 BTC remains outstanding, and…

— Samson Mow (@Excellion) September 7, 2026

Liquid Network recovered 3,400 BTC

Operational Status: Peg Suspended and Backing Gap Unclear

L-BTC deposits and withdrawals remain suspended. Liquid has not said whether the remaining 598.5 BTC will be returned, how it will cover any resulting gap in L-BTC backing, or when normal sidechain and peg operations will resume. Users cannot move assets through the peg while services are offline, and full accounting of reserves and liabilities is pending.

Hacker Message

Industry Reaction

Ledger Chief Technology Officer Charles Guillemet questioned the whitehat characterization. He stated that retaining about 600 BTC does not align with bug-bounty norms and described the situation as closer to extortion. The response underscores ongoing concerns about custody, incident disclosure, and labeling of attacker-controlled funds.