Liquid recovers 3,400 BTC; attacker retains 598.5 BTC

On Sept. 7 Liquid’s federation wallet received 3,400 BTC in a recovery transaction that confirmed at 16:09:25 UTC in Bitcoin block 965950. The transfer followed a reserve outflow earlier that day.

Blockchain records show the holder address moved about 3,998.5 BTC in the later transaction. Roughly 3,400 BTC went to the federation wallet and about 598.5 BTC remained at the attacker’s address. The initial federation outflow is reconstructed at approximately 3,996 BTC. Public records do not show that the retained 598.5 BTC was an agreed bounty.

Before returning funds, the attacker posted on-chain messages describing themselves as a white-hat and writing that they were “sending most back.” An on-chain note later read, “is that ok?” An earlier on-chain message at 09:41:26 UTC said bridge nodes had been patched and that funds were safe to return; a reconstruction reports the message signature verified against the federation’s security key. That patch note does not by itself confirm that withdrawal services were restored.

Blockstream’s status page listed an active Liquid security incident and a major public bridge outage on Sept. 8. Liquid had stated on Sept. 6 that bridge nodes were disabled and that exchanges had paused or would pause L-BTC deposits and withdrawals. Some service providers announced swaps, peg-ins and peg-outs were paused and asked users not to send new peg-in or peg-out deposits.

L-BTC tokens are meant to be backed by Bitcoin held in the federation wallet. Redeeming L-BTC requires burning the token and releasing Bitcoin through the federation; ordinary users generally need an authorized federation member or a service provider to perform the conversion. The returned 3,400 BTC increases the wallet balance but does not by itself reconcile recoverable reserves with outstanding L-BTC obligations.

The next public checkpoints for holders are a confirmed restart of public bridge nodes and a reserve reconciliation that accounts for recoverable Bitcoin against legitimate outstanding L-BTC. The on-chain record provides three concrete facts: a recovery of 3,400 BTC to the federation wallet confirmed in block 965950, a remaining balance of about 598.5 BTC at the attacker address, and ongoing outage and incident notices on the federation’s status dashboard.