Crypto· Bitcoin

Liquid Hackers Return $270M in Bitcoin After Swiping $320 Million

Hackers who accessed Liquid Network's bridge returned approximately 3,400 Bitcoin worth $269 million after Blockstream confirmed security patches were deployed, though nearly 600 BTC valued at $47 million remains unaccounted for. The actors claimed white-hat status but retained a portion of the stolen funds, prompting skepticism from industry observers about their ethical intentions.

By AI NewsroomPublished about 15 hours agoUpdated about 15 hours ago4 views

Liquid Hackers Return $270M in Bitcoin After Swiping $320 Million

Why It Matters

The incident highlights ongoing security vulnerabilities in blockchain infrastructure and raises questions about the reliability of sidechain networks that custodize user assets. The partial return and ambiguous resolution leave Liquid's operational status uncertain and its ability to restore confidence in its security mechanisms unclear.

Key Facts

Total amount withdrawn: Approximately 4,000 BTC
Amount returned: 3,400 BTC (approximately $269.2 million)
Amount still held: Nearly 598.5 BTC (approximately $47 million)
Recovery percentage: About 85% of funds
Timeline: Incident began Sunday; return occurred Monday

The Liquid Network experienced a significant security breach when approximately 4,000 Bitcoin were withdrawn through its bridge system following a customer deposit to SideSwap's peg-out service. The individuals responsible for the withdrawal identified themselves as white-hat hackers—security researchers who discover vulnerabilities to help organizations improve their defenses—through messages embedded in Bitcoin transactions.

The situation evolved into a negotiation conducted entirely on-chain, with the actors requesting that Blockstream, Liquid's developer, patch identified security flaws before fund return. After Blockstream published a signed message confirming that bridge nodes had been patched and were safe, the actors transferred the majority of the stolen funds back to Liquid's federation wallet on Monday. The return represented recovery of approximately 85 percent of the incident's total loss.

However, the partial nature of the return has cast doubt on the actors' white-hat characterization. Charles Guillemet, chief technology officer at Ledger, expressed skepticism on social media, suggesting the retained 600 BTC appeared inconsistent with genuine ethical hacking practices and resembled extortion more than legitimate security disclosure. The actors have not publicly explained why they maintained possession of the remaining funds or whether they intend to return them.

Following the initial withdrawal, Liquid disabled its bridge infrastructure and requested cryptocurrency exchanges suspend deposits and withdrawals of L-BTC to prevent further complications. The network has yet to announce its timeline for resuming normal operations or clarify how it will address the outstanding funds and any resulting gaps in its Bitcoin reserves. Blockstream declined immediate comment on the incident's resolution.