Liquid gets 3,400 BTC back as the actor retains about $47m

The party that withdrew bitcoin from Liquid’s federation reserves has returned 3,400 BTC, while retaining roughly 598.5 BTC, worth about $47m at the desk’s 8 September price snapshot. The return is confirmed on Bitcoin. The terms under which the actor keeps the balance remain unconfirmed in the public statements reviewed for this article.

The incident concerns the reserves backing L-BTC, the bitcoin-linked asset on the Liquid sidechain. On 6 September, Liquid acknowledged a withdrawal of roughly 4,000 BTC, valued at about $320m at the time. Its public bridge incident remained active on Blockstream’s status page when checked on 8 September.

The return, down to the satoshi

The recovery transaction confirmed in Bitcoin block 965,950 at 16:09:25 UTC on 7 September. It has two outputs: exactly 3,400 BTC to the federation reserve address, and 598.49955894 BTC back to the address controlling the withdrawn funds. The transaction paid a fee of 1,768 satoshis.

That is approximately an 85% return against the 4,000 BTC headline amount. The retained output is about 15%. Both percentages are rounded: the transaction includes earlier movements, and the original reserve batch also processed other outputs.

The follow-up is useful because the funds continued moving within the same address. At 14:25:31 UTC on 8 September, a new transaction spent an output controlled by that address and carried 598.49988609 BTC forward to it. It also sent 1,000 satoshis to the federation address and included a message stating that future messages would use plaintext.

At CoinGecko’s $78,664 bitcoin snapshot at 16:33 UTC, 598.5 BTC equalled about $47.08m, and 3,400 BTC equalled about $267.46m. Those are dated conversions. The approximately $320m figure in the initial incident notice valued the earlier gross withdrawal.

How Liquid released the bitcoin

Liquid’s normal peg-out process destroys L-BTC on the sidechain and releases bitcoin from federation-controlled reserves. Authorised peg-out requests are processed in batches by the network’s watchmen, as described in its technical documentation.

SideSwap’s statement says a customer submitted 4,000 L-BTC at 14:05 UTC on 6 September. SideSwap processed a valid peg-out authorisation and burned the L-BTC; the federation then paid 3,996 BTC to the customer’s Bitcoin address. SideSwap attributes the creation of those L-BTC to an Elements software bug, citing Blockstream’s investigation.

Liquid’s own incident statement says the SideSwap Peg-out Authorization Key remained uncompromised. That makes software validation central to the account given by the operators. A precise code-level explanation still requires a verified technical post-mortem.

The original Bitcoin batch spent 4,019.44426085 BTC from the reserve address across 83 inputs, then returned 16.77817050 BTC to that same address as change. Subtracting that change gives a 4,002.66609035 BTC net reduction at the address, including the fee and other payouts in the batch.

The batch’s largest outside output was 3,996.01834922 BTC. These figures describe different parts of one transaction. Counting every input as stolen would also count the federation’s change; treating every outside output as belonging to one customer would go beyond the transaction alone.

A self-described white hat and an unresolved retained share

The white-hat description began with the actor. An on-chain message described its sender that way and invited contact on Bitcoin. Liquid used qualified wording in its acknowledgement.

The 598.5 BTC was retained as change in the return transaction. Describing it as an agreed bounty would add a claim about consent and terms that the transaction cannot establish. The public record supports a substantial recovery and a substantial retained balance, with the agreement between the parties still to be established.

Restoring access for L-BTC holders

For holders, the operational milestone is the resumption of usable peg-outs. Blockstream’s status notice continued to list the incident as active, while SideSwap’s published service notice asked users to wait for confirmation that deposits and withdrawals had resumed.

The 3,400 BTC return replenishes the federation address. A reconciliation of the reserves against outstanding L-BTC, followed by a confirmed service restart, will establish the position for holders seeking redemption. Those are the next concrete recovery milestones to follow in the operators’ updates.