Liquid Hackers Return 3,400 BTC, Keep 598.5 BTC ($47M) as Bounty

The party that drained roughly 4,000 BTC from Blockstream’s Liquid Network federation wallet on Sunday sent 3,400 BTC back on Monday, according to two independent outlets tracking the return transaction directly on chain. About 598.5 BTC, worth close to $47 million at current prices, remains at the same holder address.

Bitcoin Magazine and Protos both identify the return as a single transaction that moved exactly 3,400 BTC to Liquid’s labeled peg-out script, with the balance sent back to the attacker’s own address as change. That split puts roughly 85% of the original haul back with the network, a figure BeInCrypto also reports independently. Decrypt frames the same move in dollar terms: about $270 million returned against roughly $320 million taken in Sunday’s drain.

What Two Sources Confirm

The core sequence is corroborated across multiple reports. A self-described white-hat party pulled the funds out of the Liquid federation wallet on Sunday. The address holding the coins then posted an OP_RETURN message on chain reading roughly “we are whitehats, contact us on chain.” A Blockstream-linked address replied with contact instructions, and the two sides exchanged further on-chain notes, some encrypted with PGP keys tied to Blockstream, before the 3,400 BTC transfer went through.

Blockstream’s side of the exchange reportedly confirmed that the network’s bridge nodes had been patched before accepting the funds back, a detail that lines up with earlier confirmation that Liquid’s sidechain was paused and bridge nodes disabled after the initial incident. The remaining 598.5 BTC sitting at the attacker’s address functions, in effect, as a bounty payment the party kept rather than returned.

Where the Sourcing Gets Thinner

Some granular detail comes from a single outlet and should be read that way. Bitcoin Magazine cites a specific return transaction hash, bc49a46d, confirmed at 16:09 UTC on September 7, and quotes an exchange in block 965869 where the white hats asked whether sending “most” of the funds back was acceptable, followed by a message insisting the bug be fixed first: “Please fix the bug first. The chain is under risk at latest commit right now.” That level of dialogue transcript is not independently verified by the other three reports, which describe the same broad negotiation but without matching that exact wording or block number.

Because on-chain OP_RETURN messages are permanent and publicly readable, anyone running a node can check the substance of the exchange directly rather than taking a screenshot on trust. That is a meaningfully different situation from a claim resting on an anonymous tip or a single unverifiable quote.

Why the Remaining 598.5 BTC Matters

For holders of Liquid-pegged assets and exchanges that suspended LBTC deposits during the incident, the 3,400 BTC return restores most of the federation wallet’s balance and, combined with the earlier confirmation that bridge nodes were patched, points toward the sidechain resuming normal operation. The 598.5 BTC left with the attacker is not disputed as missing; it is openly held at a known address and treated in the reporting as an accepted fee rather than an unresolved loss.

No source among the four reports the remaining balance as still moving or being negotiated further. As of Monday’s confirmed transaction, the figures at the two addresses, 3,400 BTC back with Liquid and 598.5 BTC with the original holder, add up to the roughly 4,000 BTC total first reported missing on Sunday.

Read more: Liquid Network’s 4,019 BTC ($320M) Drain: What Two Sources Actually Confirm

Sources

• bitcoinmagazine.com
• beincrypto.com
• decrypt.co
• protos.com