White-hat hackers have returned 3,400 BTC—approximately $270 million at current prices—of the roughly 4,000 bitcoin stolen from the Liquid Network during a security incident on Sunday, according to reports from CoinDesk and Cointelegraph.
The breach, which targeted Liquid's federation wallet, originally drained approximately $320 million worth of Bitcoin from the sidechain network. The returned funds represent 85% of the total amount withdrawn during the incident, leaving nearly $47 million in outstanding bitcoin still unrecovered.
The identity of the hackers remains unconfirmed, though both sources characterize them as "supposed white-hat hackers" or simply "white hats." This designation suggests the actors may have executed the exploit to demonstrate security vulnerabilities rather than for pure financial gain, though the ongoing negotiations for the remaining funds indicate complex motivations.
Liquid Network, a Bitcoin sidechain operated by Blockstream that enables faster and more confidential transactions, has been working to address the security lapse. Cointelegraph reports that the network is preparing for a restart following the incident and the substantial return of funds.
The federation wallet compromise represents a significant test for Liquid's security model. Unlike Bitcoin's base layer, Liquid relies on a federation of functionaries to manage the pegged bitcoin backing the sidechain, creating a different security profile with distinct trade-offs between speed, privacy, and decentralization.
The partial return of stolen funds in cryptocurrency exploits remains relatively uncommon. Most high-profile hacks, such as the Ronin Bridge exploit or various DeFi protocol breaches, have seen minimal recovery of assets. The 85% return rate in this case stands out as an unusual outcome, whether driven by the actors' stated white-hat intentions, difficulty in laundering such a large bitcoin sum, or other factors not disclosed in available reports.
The outstanding $47 million in bitcoin—roughly 600 BTC at current valuations—remains in limbo as discussions between the network and the hackers continue. The outcome of these negotiations could establish precedents for how sidechain operators and other cryptocurrency platforms engage with security researchers or exploiters who retain portions of taken funds.
This incident arrives as the cryptocurrency industry continues grappling with bridge and cross-chain protocol security. Sidechains and interoperability solutions remain frequent targets due to their complexity and the large value they custody, even as they solve genuine scalability and functionality limitations in base-layer blockchains. The Liquid Network's ability to recover the majority of funds and resume operations will likely inform risk assessments of similar federation-based architectures going forward.