Liquid Network has recovered 3,400 BTC from the actors behind Sunday's near-total drain of its Bitcoin federation reserve, restoring roughly 85% of the funds after a negotiation conducted entirely through Bitcoin transactions.

The 3,400 BTC return was confirmed on September 7 at 16:09 UTC. Approximately 598.5 BTC remained with the self-described white hats, a balance worth about $47.5 million at current Bitcoin prices.

Blockstream Patch Preceded the 3,400 BTC Return

Liquid, a federated Bitcoin sidechain developed by Blockstream, issues L-BTC as a bitcoin-backed asset whose peg depends on the reserve held by its Federation members. The actors withdrew nearly 4,000 BTC on September 6 after unbacked L-BTC entered SideSwap's authorized peg-out path, cutting Liquid's federation reserve from more than 4,200 BTC to roughly 200 BTC.

The initial withdrawal, valued at about $320 million, prompted Liquid to disable bridge nodes and led exchanges to suspend L-BTC deposits and withdrawals while Blockstream and Federation members investigated the Elements-related failure. Elements is the open-source protocol codebase on which Liquid is built.

Negotiations then moved fully onchain. The actors offered to return "most" of the Bitcoin but demanded that the vulnerability be repaired first, warning that the chain remained exposed until every affected node had received the patch.

Blockstream subsequently transmitted a PGP-signed "safe to return" message confirming that bridge nodes had been patched. The 3,400 BTC repayment followed shortly afterward.

598.5 BTC Remains With Self-Described White Hats

The repayment transaction sent exactly 3,400 BTC back to the Liquid federation address, while approximately 598.5 BTC returned as change to the address controlled by the actors.

The remaining balance represents roughly 15% of the Bitcoin involved in the withdrawal. No publicly disclosed agreement establishes the 598.5 BTC as an approved bounty, making it more accurate to treat the amount as retained funds while negotiations continue.

The structure differs from recoveries where bounty terms were set out explicitly. Renegade recovered more than 90% of assets from its Arbitrum exploit after offering the attacker a defined return arrangement that allowed less than 10% to be retained as a whitehat bounty.

The Liquid actors initially identified themselves through an onchain message reading "we are whitehats. contact us on chain," but the size and legal status of the retained Bitcoin remain unresolved.

Liquid Prepares Coordinated Network Restart

The recovery substantially restores the Bitcoin reserve backing L-BTC after the withdrawal temporarily removed about 95% of its support. Updated software has been deployed, while Liquid Federation members prepare the network for a coordinated restart and further hardening of the affected infrastructure. A smooth restart and evidence that the patched peg-out path holds under renewed volume are the key remaining steps before exchanges are likely to restore full L-BTC deposit and withdrawal support.

Bitcoin itself was never compromised, and Liquid's other issued assets, including USDT and DePix, were not directly affected.

Liquid's public bridge nodes remained under the security response on September 8, with the 598.5 BTC still held at the withdrawal-linked address as Federation members prepare the sidechain for restart.