$47M Still Missing After Liquid Hack as Blockstream Bargains With 'White Hats'

Blockstream is engaged in talks to recover the remaining roughly 598.5 BTC after an exploit drained about 4,000 BTC from the Liquid sidechain over the weekend. The individuals responsible returned 3,400 BTC on Monday, leaving about 15% of the stolen funds outstanding; Liquid said discussions are ongoing to secure the return of the remainder but did not disclose terms or a timeline.

Developers traced the breach to a flaw in Liquid's Elements software that allowed the creation of unbacked L-BTC tokens. Those tokens were accepted as valid at the transaction level and then exchanged for reserve Bitcoin via SideSwap, a Liquid Federation member that operates a withdrawal service. Because the invalidation occurred before the peg-out process began, both SideSwap’s node and Liquid’s functionary nodes processed the withdrawals.

The exploit reduced Liquid's reserve from roughly 4,205 BTC to 197 BTC after that withdrawal and others processed before operations were halted. Liquid said USDT and other tokens issued on the network were not affected by the vulnerability, but users could not transact while the network remained paused. The project also emphasized that federation functionaries were not compromised and that no private keys were exposed, saying the peg-out mechanism itself operated as designed.

The actors posted a message on Bitcoin’s blockchain identifying themselves as white-hat security researchers after the withdrawals, but that claim drew skepticism from some industry figures; Ledger CTO Charles Guillemet wrote that retaining 600 BTC looked more like extortion than a sanctioned white-hat action. Meanwhile, Blockstream has pushed a patch to bridge nodes and is preparing an emergency update now under review; once finalized, network operators plan further changes to correct the ledger state, reject the invalid withdrawal and resume normal operations, with recovering the remaining funds listed as an immediate priority.