Liquid recovers 3,400 BTC, but 598 BTC remains missing

Liquid Network has recovered 3,400 BBTC$78,419.00▼1.31% from the 4,000 BTC withdrawn from its federation wallet on Sunday, but approximately 598 BTC, worth roughly $47 million, remains outstanding. The figures come from CoinDesk’s report, which also says the initial withdrawal drained almost the entire reserve stash of around 4,200 BTC.

The return covers 85% of the stolen amount: 3,400 BTC returned divided by 4,000 BTC taken. That leaves roughly 15% of the withdrawal unrecovered, despite the negotiations and vulnerability patching that preceded the transfer.

Samson Mow, JAN3 CEO and a former Blockstream chief strategy officer, said in the CoinDesk report: “Approximately 598 BTC remains outstanding, and Blockstream continues to engage with the white-hat hackers.” The 598 BTC figure works out to about $46.9 million using the $78,365 Bitcoin price listed by CoinGecko: 598 multiplied by $78,365.

The distinction matters for L-BTC holders. Liquid’s federation wallet backs the sidechain token with real bitcoin on a one-for-one basis, so the returned funds ease the immediate collateral shortfall while the outstanding balance leaves the reserve below the amount taken before the exploit. The network remains paused.

Blockstream and Federation members are making additional fixes and security improvements, resolving a chain split, and preparing for a safe restart, Mow said. Until that happens, users face a direct operational restriction: Mow said, “No user action is needed, and please do not send Bitcoin to Liquid peg-in addresses until we confirm the network has restarted.”

The original withdrawal was processed through SideSwap’s Peg-out Authorization Key. SideSwap said the L-BTC involved originated from a bug in Elements, the open-source software underpinning Liquid, according to Cointelegraph’s report.

Blockstream contacted the actors through signed messages embedded in Bitcoin transactions. The actors identified themselves as white hats and said they would return most of the funds once the vulnerability was fixed and every node had installed the patch.

That account explains why most of the bitcoin came back, but it leaves the recovery conditional. Ledger chief technology officer Charles Guillemet said that if the roughly 600 BTC still under their control represented a negotiated reward, the arrangement looked “more like extortion than white-hat hacking.”

For Liquid users, the consequence is concrete: L-BTC activity remains constrained until the restart is confirmed, and nearly 600 BTC is still unresolved. The terms of the ongoing engagement, including whether that balance will be returned or retained as a reward, were not disclosed in the supplied reports.