An unidentified group behind Sunday's Liquid Network breach has returned 3,400 of the 4,000 BTC withdrawn from the network's federation wallet, according to information shared by Samson Mow, a former Blockstream chief strategy officer who has posted regular updates on the incident. Approximately 598 BTC, worth roughly $47 million, remains outstanding.

Liquid has not resumed normal operations. Blockstream and the network's federation members are working on additional security measures, resolving a chain split that emerged during the pause, and preparing to confirm that L-BTC is fully backed before a restart. The pause leaves users of the sidechain unable to move assets across the Bitcoin bridge until operators complete that work.

The incident comes as BTC trades at $78,500, down 1.5% over the past 24 hours and down 0.5% over the past week. Daily trading volume sits at $27.9 billion.

Most of the Withdrawn BTC Has Been Returned

The group has been described as purported white-hat hackers. After Blockstream said the affected bridge nodes had been patched, the group sent 3,400 BTC back to Liquid's federation wallet.

The negotiations took place publicly through messages written into Bitcoin transactions rather than through an official communications channel. Using the Bitcoin ledger itself as a message board is possible because arbitrary data can be embedded in transaction outputs, and in this case it provided a visible record of the back-and-forth while the network itself was offline. The status of the remaining 598 BTC remains unresolved, while Blockstream continues to engage with the group, according to reporting on the incident.

JUST IN: 4,000 Bitcoin worth $320 million withdrawn following Liquid Network hack. The hacker is now communicating with network maintainers through on-chain Bitcoin transactions & intends to return the $BTC after the vulnerability is fixed. pic.twitter.com/OXpS1X3oqK

— Watcher.Guru (@WatcherGuru) September 7, 2026 (https://x.com/WatcherGuru/status/2096826035736088800?ref_src=twsrc%5Etfw)

How Liquid's Reserve System Was Affected

Liquid Network is a Bitcoin sidechain built by Blockstream. It is designed as a faster, more private settlement layer on top of Bitcoin and is supported and maintained by a federation that includes exchanges and miners. Unlike Bitcoin's main chain, where security relies on proof-of-work mining, Liquid relies on that federation of functionaries to sign blocks and custody the pegged bitcoin, which concentrates responsibility for the reserve in the federation wallet.

Each unit of its token, L-BTC, is intended to be matched one-for-one with bitcoin held in a shared federation wallet. Attackers withdrew 4,000 BTC, valued at about $320 million at the time, from a reserve of roughly 4,200 BTC, leaving 197 BTC in the federation wallet.

The withdrawal left L-BTC far from fully backed. Operators disabled bridge nodes, paused the network, and instructed exchanges to freeze L-BTC deposits and withdrawals. Other assets issued on Liquid, including Tether, were not affected.

Security Work Continues Before Restart

Update: 3,400 BTC of the roughly 4,000 BTC withdrawn on September 6 has been returned to the @Liquid_BTC Federation wallet. The return followed confirmation from @Blockstream that the affected bridge nodes have been patched. Approximately 598 BTC remains outstanding, and…

— Samson Mow (@Excellion) September 7, 2026 (https://x.com/Excellion/status/2097060644977877433?ref_src=twsrc%5Etfw)

According to Mow's update, the network remains paused while Blockstream and federation members make additional fixes and security improvements, address the chain split, and prepare for a safe restart. Available reporting does not provide technical detail about the vulnerability.

Remaining work includes completing the security response, resolving the chain split, and restoring confidence that L-BTC is fully backed before normal activity resumes.

Mow said that approximately 598 BTC remains outstanding and that Blockstream continues to engage with the purported white-hat hackers. He also advised users not to send bitcoin to Liquid peg-in addresses until the network restart has been confirmed.

The return of 3,400 BTC eases the immediate collateral shortfall, but it does not resolve the incident. Liquid operators still need to complete security work, address the chain split, and establish that L-BTC is fully backed before the network can restart. Until then, users are being asked to wait for network confirmation.

Source: 99Bitcoins