Bitcoin: Liquid Recovers 3,400 of the 4,000 BTC Withdrawn

Liquid Network has recovered 3,400 of the approximately 4,000 BTC withdrawn from its federated wallet during the September 6 incident, representing around 85% of the funds. The actors, who describe themselves as “white hat” hackers, returned the funds after Blockstream confirmed that a patch had been deployed on the affected nodes. However, approximately 598 BTC, worth nearly $47 million, remain under their control, and the Liquid network is still suspended. Bitcoin itself was not compromised.

Bitcoin: 3,400 BTC Return to Liquid’s Reserves

The return of 3,400 BTC considerably reduces the financial urgency that emerged on Sunday. The incident had removed approximately 4,000 BTC from a reserve holding close to 4,200 BTC, leaving just 197 BTC in the federated wallet. The amount withdrawn was then worth nearly $320 million.

The incident comes a few weeks after the Coldcard vulnerability that triggered the movement of 233,000 BTC. However, the mechanics are very different.

Liquid is a Bitcoin sidechain developed from the Elements software. To transfer BTC to the network, users lock bitcoins on the main blockchain and receive the equivalent in the form of L-BTC. Liquid’s official documentation states that each L-BTC should normally be backed on a 1 BTC for 1 L-BTC basis by the federation.

The withdrawal of almost the entire reserve therefore temporarily broke that economic relationship.

With 3,400 BTC returned, the situation has improved significantly. It is not yet fully resolved: Samson Mow, former Blockstream executive and current CEO of JAN3, says that approximately 598 BTC remain to be recovered and that discussions with the actors are continuing.

An Elements Vulnerability, Not a Bitcoin Network Breach

The technical detail is probably the most important aspect of the incident: the Bitcoin blockchain was not hacked, and no private key from the federated wallet appears to have been compromised.

According to information provided by Blockstream, the problem stemmed from a software bug affecting certain nodes using Elements, the technology on which Liquid is built. The funds subsequently passed through SideSwap, infrastructure normally authorized to interact with the network.

This is quite different from a conventional theft in which hackers obtain a protocol’s seed phrase or administrative keys. Key compromises nevertheless remain one of the major sources of losses in crypto.

The actors then used Bitcoin itself to communicate. Messages were embedded in transactions to ask Blockstream to fix the vulnerability before the funds were returned. Once the affected nodes had been patched, 3,400 BTC were sent back in a single transaction to the federation’s wallet.

The term “white hat” should nevertheless be treated with caution. The actors describe themselves that way and have indeed returned most of the funds. They still hold nearly 600 BTC, and no public information currently allows this amount to be considered an officially negotiated bounty.

In other words, their claimed ethical intent has not yet been fully demonstrated.

Liquid Remains Halted Despite the Return of the Funds

Blockstream is not restarting Liquid immediately.

Operators still need to strengthen security, resolve a chain split that emerged during the suspension and verify that the system can restart without compromising L-BTC backing. Samson Mow has asked users not to send BTC to peg-in addresses until the official resumption has been confirmed.

Other assets issued on Liquid, notably USDT, were not directly affected by the incident, according to the information available.

Liquid nevertheless remains an important piece of infrastructure. Launched in 2018, the sidechain is aimed in particular at exchanges and Bitcoin capital markets. It enables faster settlement, with blocks produced every minute, confidential transactions and the issuance of tokenized assets. Its website currently displays approximately $5 billion in total value on the network.

That is precisely what makes the incident notable. Bitcoin operated normally throughout the affair; the weakness was found in the infrastructure built around it. Tracking bitcoins linked to the Lazarus Group had already shown how the main blockchain could continue to provide a public trail even when surrounding infrastructure was compromised.

The return of 85% of the BTC currently avoids the most difficult scenario for Liquid. Two questions nevertheless remain before the case can be considered closed: what will happen to the 598 BTC still held by the actors, and, above all, does the applied patch completely eliminate the class of vulnerability that made the initial withdrawal possible?

For Liquid, recovering the bitcoins was the first priority. Restoring confidence in the mechanism that backs every L-BTC on a 1-to-1 basis will be the next.