The Liquid Network said on Tuesday that services were back up and running, more than one month after hackers stole 4,000 bitcoin — worth about $320 million at the time — from the network's federation wallet before returning most of the funds in what they described as a "white hat" operation.

Writing in a blog post, the Liquid Network said it was entering "the final stages of recovery with enhanced security."

The 4,000 bitcoins were stolen in September from the federation wallet that backs the Blockstream-developed sidechain. Blockstream was able to negotiate the return of most of the funds.

Blockstream CEO Adam Back confirmed on X on Tuesday that swap functionality had been fully restored:

LBTC:BTC swaps full service again. swap @liquid_btc to/from mainchain BTC on @side_swap . swap @liquid_btc to/from lightning on @AquaBitcoin .

— Adam Back (@adam3us) October 20, 2026

According to the post, LBTC-to-BTC swaps between Liquid and the Bitcoin mainchain through side_swap, and between Liquid and the Lightning Network through Aqua, are once again operating at full service.

"The final phase of restoration involves reestablishing the network's full 1:1 bitcoin backing, followed by the controlled reactivation of Federation peg-outs for authorized PAK key holders," the Liquid blog post read. "The Federation, Blockstream, and independent security experts have made substantial progress toward this objective, with the necessary technical infrastructure and safeguards now in place."

Peg-outs — the mechanism for converting LBTC back into on-chain bitcoin, authorized through the federation's peg authorization keys, known as PAK — are the last piece of full service yet to return, with the blog post framing their reactivation as coming only after the 1:1 backing is fully restored.

The post added that phased swaps had been reintroduced as part of what the network has described as a staged recovery.

Liquid is a layer-2 network created by Blockstream that allows users to quickly move assets backed 1:1 with bitcoin. On applications that support the Liquid Network, people can swap stablecoins for bitcoin and for bitcoin on the Lightning Network. That 1:1 guarantee is what the September exploit put at risk, which is why the restoration of full backing sits at the center of the recovery's final phase.

The hackers obtained the 4,000 bitcoins by exploiting an inflation bug on the Liquid sidechain. The flaw allowed them to create more than 4,000 LBTC — a token supposedly backed by bitcoin — that did not exist before, which they then cashed out for real on-chain BTC.

The hackers claimed to be white hat hackers and subsequently exchanged messages with Blockstream by writing them into Bitcoin blocks. Critics, however, argued that their conduct was not entirely "white," given that they kept 15% of the stolen funds, worth millions of dollars.

In one message, the hackers slammed Blockstream as "delusional, greedy, and arrogant," and threatened to reveal all of Blockstream's encrypted messages in the exchange unless the company paid the hackers 10% of the bitcoins as an official bounty.

"You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess," the message read.

As per the latest public knowledge, the hackers are still holding onto around 600 bitcoins — or 15% of the total funds — worth close to $50 million at today's prices. It is not clear whether Blockstream has reached a settlement with the hackers in private. Whether the Federation completes the 1:1 backing restoration and the reactivation of peg-outs — and how the hackers' remaining stake is ultimately resolved — are the open questions as the recovery moves toward its conclusion.

The development was reported by Bitcoin Magazine's Mathew Di Salvo.