Blockstream is negotiating with the individuals behind the Liquid Network exploit to recover approximately 598.5 BTC that remains outstanding, according to Liquid Network.

The attackers returned 3,400 BTC on Monday, leaving roughly 15% of the funds unreturned. The outstanding Bitcoin is worth about $47 million based on the figures cited by Liquid.

Liquid Network said Tuesday that Blockstream, the Bitcoin infrastructure company behind the sidechain, is continuing discussions with the still-unidentified individuals responsible for exploiting the network for approximately $320 million in Bitcoin.

“Discussions between Blockstream and the individuals responsible are ongoing to secure the return of the remaining funds,” Liquid said in an incident report on X.

The negotiations follow Sunday’s withdrawal of approximately 4,000 BTC. A flaw in Liquid’s underlying Elements software allowed unbacked L-BTC tokens to be created and exchanged for Bitcoin held in Liquid’s reserves. The individuals returned 3,400 BTC on Monday, leaving about 600 BTC, valued at roughly $47 million, still missing.

Liquid did not disclose the terms of the discussions or provide a timeline for recovering the remaining Bitcoin.

According to Liquid, the individuals exchanged the Bitcoin through SideSwap after creating the tokens. SideSwap is a Liquid Federation member that operates a withdrawal service. The software’s transaction checks accepted the unbacked tokens as valid before the withdrawal process began.

“Because the validation failure occurred at the transaction level before the peg-out was initiated, both SideSwap’s node and the Liquid Network’s globally distributed functionary nodes accepted the LBTC as valid,” the developers wrote.

Liquid’s account places the failure in the software’s transaction-validation path: the company said the federation functionaries were not hacked and that no private keys were compromised. That distinction informs the planned remediation, which includes an emergency software update and corrections to the network’s state.

Liquid’s reserve declined from approximately 4,205 BTC to 197 BTC after the exploit-related withdrawal and other withdrawals processed before operations were halted. Liquid said the vulnerability did not affect USDT or other tokens issued on Liquid, although users were unable to transact while the network was paused.

“The Liquid Federation functionaries were not hacked, and no private keys were compromised,” Liquid said. “The peg-out mechanism that authorizes withdrawals to whitelisted addresses operated as designed.”

At the time of the exploit, the individuals identified themselves as white-hat security researchers in a message recorded on Bitcoin’s blockchain. However, some observers, including Ledger Chief Technology Officer Charles Guillemet, remained skeptical of that claim after most of the funds were returned.

“The ‘white hats’ still hold 600 BTC,” Guillemet wrote on X. “If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!”

According to Liquid Network developers, Blockstream is preparing an emergency update while the fix undergoes review. The update follows a patch applied to the network’s bridge nodes on Monday. After the update is finalized, network operators will make additional changes to restore operations and correct the network’s state, including rejecting the invalid withdrawal.

“Our immediate priorities are recovering the remaining funds and resuming normal network operations safely and as quickly as possible,” Liquid said.

Source: Decrypt