NextFin News - The white-hat hackers who drained roughly $320 million from the Liquid Network on Sunday have returned 3,400 of the 4,000 bitcoin they took, but about 598 BTC — worth roughly $47 million — remains outstanding as Blockstream and federation members race to patch a node-software bug, resolve a chain split, and restore full backing to the L-BTC token before the paused sidechain can restart.
The partial recovery, confirmed Monday by Samson Mow, a prominent Bitcoin advocate and former Blockstream chief strategy officer who has been relaying official-style updates on the incident, leaves the network in an awkward middle state: most of the money is back, but the trust that underpins a "fully backed" bitcoin sidechain has taken a hit that a software patch alone cannot fully repair. The incident is the latest in a string of bridge and sidechain breaches that have cost the crypto market billions over the past few years — and the first to end with the attackers negotiating in public, returning most of the funds, and keeping a seven-figure bounty with no visible legal consequence.
The Incident: A Patch Broke What Keys Could Not
The exploit did not crack the Liquid Federation's 11-of-15 multisig wallet on the base Bitcoin chain. It did something more uncomfortable: it convinced Liquid's own node software to treat a fake transaction as real.
On Sunday, attackers withdrew around 4,000 of the roughly 4,200 bitcoin held in the federation wallet that backs L-BTC, the network's wrapped bitcoin token, the Liquid Network said in a post on X. At bitcoin's price near $79,000 at the time, the withdrawal was worth about $320 million. The federation wallet was left with just 197 BTC — meaning L-BTC's one-for-one backing ratio briefly fell to roughly 4.7 percent before any funds came back. In practical terms, for a window of hours, more than 95 percent of the L-BTC in circulation was a claim on bitcoin that no longer existed in the reserve.
According to security specialists, the flaw sits at the node level in Liquid's transaction-validation software, not in its keys or hardware security modules. A summary posted by pseudonymous Bitcoin developer Mononaut traced the vulnerability to cryptographic proof code introduced in 2019; a software update pushed last week attempted to fix that issue but introduced a new bug instead. Nodes running the patched software accepted the exploit transaction; nodes running official versions that did not contain the bug rejected it and stalled at block height 4,050,335, producing the chain split that operators must now unwind.
The newly created, unbacked L-BTC was then routed through SideSwap's peg-out service, and the federation released roughly 3,996 bitcoin to a Bitcoin address controlled by the attacker. The Liquid Network's official account said the SideSwap authorization key and the federation's other keys were not compromised. The signers did exactly what they were supposed to do — because the software told them the peg-out was legitimate.
Operators responded by disabling bridge nodes, pausing the network, and instructing exchanges to freeze L-BTC deposits and withdrawals. Other assets issued on Liquid, including tether, were not affected. That containment matters: Liquid is not just a token but an issuance platform used by exchanges and trading firms for faster, more private settlement, and a broader contagion into the other assets it hosts would have multiplied the damage.
Why does a federated sidechain need a multisig at all? Liquid is operated by the Liquid Federation, a group of more than 80 member companies — exchanges, trading firms, wallet providers, and infrastructure businesses — though only 15 currently run the specialized functionary nodes at the heart of the network. Those functionaries both produce and sign Liquid blocks and secure the bitcoin held in the federation's 11-of-15 multisig wallet on the base Bitcoin network. The design assumes that no single member can move the reserves; at least 11 of the 15 must agree. Sunday's exploit bypassed that assumption entirely by never asking the multisig to move anything it did not believe it was authorized to move.
The Return: Negotiation by OP_RETURN, and a 598-Bitcoin Keep
The actors identified themselves as white-hat hackers and negotiated in public, writing messages into Bitcoin transactions using OP_RETURN — the same mechanism Bitcoin users employ to embed arbitrary data in the blockchain. After Blockstream said the affected bridge nodes had been patched, they sent 3,400 BTC back to the federation wallet and kept the rest.
"Approximately 598 BTC remains outstanding, and Blockstream continues to engage with the white-hat hackers," Mow wrote. "The network remains paused while Blockstream and Federation members make additional fixes and security improvements, resolve the chain split, and prepare for a safe restart."
That sentence captures the entire tension of the moment. The 3,400-BTC return — about 85 percent of the drained funds, or roughly $270 million at current prices — is a genuine recovery, the kind that rarely happens in crypto exploits. But the retained 598 BTC is not a rounding error; it is the price the network is implicitly paying for that recovery, and it sets a precedent that will be studied by the next would-be exploiter.
The restart, when it comes, has three gates: strengthen security with additional fixes, resolve the chain split so all nodes agree on one history, and ensure L-BTC is fully backed again. Until all three are met, L-BTC remains a claim on bitcoin that cannot be redeemed — a wrapped asset whose wrapper is temporarily broken. The chain split is the technically thorniest of the three: nodes that rejected the exploit transaction diverged from nodes that accepted it at block 4,050,335, and reconciling two histories without destroying legitimate transactions or double-spending reserves requires a coordinated software upgrade across the federation.
Why a Software Bug Hurts More Than a Stolen Key
It is tempting to read the Liquid incident as a clean outcome: keys intact, most funds returned, no customer losses reported so far. The deeper read is less reassuring.
A federated sidechain like Liquid sells a specific promise: every L-BTC in circulation is matched one-for-one with real bitcoin locked in a shared wallet. That promise is enforced by code. The multisig protects the vault, but the peg-out logic decides when the vault opens. Sunday's exploit proved that the decision layer is a separate attack surface — and that it can be fooled without touching a single private key.
This is not an isolated pattern. In 2022, the U.S. Federal Trade Commission charged that Nomad's bridge hack followed the introduction of "new, inadequately tested code" to its Token Bridge smart contracts. The Liquid account points the same direction: a fix pushed to the open-source repository created the opening that the exploit walked through. The recurring lesson is that in bridge and sidechain architecture, the most dangerous moment is often the patch, not the breach.
The mechanism matters for the recovery, too. Because the base-layer multisig was never compromised, Blockstream and the federation retain control of the remaining reserves and can credibly promise a restart once the software is fixed and the chain re-converges. Had the keys been taken, the story would be a total-loss scenario rather than a pause-and-restore one. That distinction is why the market reaction has been contained rather than panicked — and why bitcoin itself barely moved on the news, trading near $79,000 with a decline of roughly 1 percent.
But the containment should not be confused with a clean bill of health. The exploit succeeded because the peg-out path trusted the node software's verdict. Any system that mints a wrapped asset on one chain against reserves held on another runs the same risk: the wrapper is only as honest as the code that watches the reserve.
The White-Hat Playbook Is Now Priced In
The second-order story here is not the bug — it is the business model that followed it. The Liquid actors followed a script that the market has seen before: drain the bridge, announce yourself as a white hat, open a public channel, return most of the funds, and keep a portion as a de facto bounty.
The history is instructive. When Poly Network was drained of roughly $611 million in 2021, the attacker returned the funds after a public back-and-forth. When Nomad lost roughly $190 million in 2022, the project offered a 10 percent white-hat bounty and saw most of the money come back — including from copycat attackers who simply replayed the same exploit. Ronin, drained of $625 million in 2022, and Wormhole, down $326 million the same year, sit on the other side of the ledger: large losses with no negotiated return. The Liquid outcome — 85 percent back within roughly 48 hours — now joins the "negotiation works" column, and it will be cited as evidence the next time an exploiter opens a channel.
The incentive effect is subtle and corrosive. If an exploiter who negotiates gets to keep 15 percent of a $320 million withdrawal — $47 million — with no visible legal consequence, then the expected cost of attacking a sidechain falls. The rational play becomes: exploit first, disclose second, bargain for the right to keep a cut. That is not a bug-disclosure regime; it is a protection racket with better public relations. And because bridge exploits are among the highest-yield attacks in crypto, the marginal incentive to find the next Liquid-style bug rises precisely because the downside has been socialized into "negotiation."
The counter-argument has real weight. White-hat disclosure norms hold that negotiated returns recover more funds than adversarial pursuit, and the Liquid outcome is Exhibit A. Chasing exploiters across jurisdictions is slow, expensive, and usually fruitless; talking to them is fast. From that vantage point, the 598 BTC is not a ransom but a success fee, and criticizing it risks discouraging the only channel that returns money to victims. The Nomad bounty, after all, worked: most funds returned, and the project lived to patch another day.
Both readings are true at once. Negotiation recovers funds; normalization lowers the cost of the next attack. The question for sidechain operators is not whether to talk — they should — but whether the terms should be set by the exploiter, and whether a 15 percent keep-rate is the market-clearing price for restraint.
Not everyone accepts the white-hat framing. Bitcoin security researcher and Liquid member Wiz argued on X: "If Sideswap broke this strict security policy, whereby members are only allowed to peg-out to offline cold storage, they are partly responsible for the theft." That shifts some of the blame from the unknown attacker to a known federation member — and raises the possibility that the post-mortem lands harder than the current "white hat" narrative suggests. If SideSwap's peg-out service processed roughly 4,000 newly created L-BTC to a destination that violated the offline-cold-storage rule, then the failure is not only in the code that minted the coins but in the policy layer that was supposed to screen the withdrawal.
Structural Risk Survives the Patch
Here is the cyclical-versus-structural call this incident demands. The bug itself is cyclical: it is a specific defect in a specific software version, and it will be fixed. The regression will be patched, the chain split will be resolved, and L-BTC will be fully backed again. On that axis, mean reversion is the base case.
But the structural layer does not revert on its own. A federated peg is only as strong as the least-tested line of code in its peg-out path. The Liquid model concentrates trust in 15 functionaries and the software they run; the exploit showed that concentration is a single point of failure even when the multisig holds. Patching the 2019-era proof code removes this vulnerability; it does not remove the architecture that made the vulnerability valuable.
That is why the incident matters beyond Liquid's users. Sidechains and bridges are the load-bearing walls of the multi-chain crypto economy — they hold the liquidity that moves between Bitcoin, Ethereum, and the chains built on top of them. Each one runs a variant of the same promise: your asset on our chain is backed by the real asset on the source chain. The Liquid exploit is a reminder that the promise is enforced by software that can be wrong, and that "fully backed" is a runtime condition, not a design guarantee.
The asymmetry is worth stating plainly. Bridge and sidechain operators collect fees and users for providing fast, cheap settlement; the risk is backstopped by code that no one audits as hard as they audit the vault. When the code fails, the operators pause the network and ask users to wait. The user bears the liquidity risk; the operator bears the reputational risk; and the exploiter, if white-hat enough, keeps a cut. That division of risk is the real structural defect.
What to Watch: The Signals That Break the Narrative
In the short term, the network stays paused. The practical watchlist is narrow and concrete: whether Blockstream publishes a post-mortem that pins the flaw on the recent patch rather than the older code path; whether the 598 BTC remains in the known hacker addresses or moves toward mixing services or exchanges; and whether the chain re-converges without a contentious fork that leaves two competing Liquid histories.
The falsifying signal is specific: if the 598 BTC moves from the hacker-controlled addresses within seven days, the "contained white-hat negotiation" narrative breaks, and the incident reverts to an ordinary theft with an unresolved $47 million loss. Equally, if the post-mortem attributes the flaw to the 2019 code rather than the patch, the "inadequately tested fix" reading — and the pressure it puts on sidechain release processes — loses its footing.
Three scenarios frame the path ahead. The base case: the 598 BTC is returned after further negotiation, the patch ships, the chain split resolves, and L-BTC resumes with restored backing and a reputational scar. The downside case: the retained coins move, the chain split proves technically difficult, and L-BTC trades at a persistent discount to bitcoin as users migrate to alternatives. The upside case: Blockstream uses the incident to overhaul its release and audit process, publishes a transparent post-mortem, and emerges as the sidechain operator that fixed its process in public view.
For exchanges and users holding L-BTC, the exposure is a frozen redemption right until the restart completes. For Blockstream and the federation, the exposure is reputational — the credibility of a "fully backed" claim that briefly stood at 4.7 percent. For the broader sidechain market, the exposure is the precedent: a successful exploit that ends with the attackers keeping $47 million and applause for the 85 percent they gave back.
The white hats returned the bitcoin. What they did not return is the assumption that a sidechain's peg is safe because its keys are.
Explore more exclusive insights at nextfin.ai.
