Liquid Network Attacker Returns 3,400 BTC, Retains Portion of Haul
An attacker who breached the Liquid sidechain broadcast a transaction Tuesday returning 3,400 BTC to the Liquid federation while sending 598.5 BTC to their own address. The transaction remains unconfirmed, and neither the federation nor the attacker has publicly commented on the partial return.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Partial Repayment Broadcast
The attacker responsible for the Liquid network breach broadcast a transaction returning 3,400 BTC to the Liquid federation wallet, according to The Defiant. The same transaction directs 598.5 BTC to an address controlled by the attacker, allowing them to retain approximately 15% of the stolen funds. The transaction was flagged as replaceable and remained unconfirmed as of Tuesday.
No Public Explanation
Neither the Liquid federation nor the attacker has released a statement explaining the partial return or the terms of any agreement. The silence leaves open whether the return represents a negotiated settlement, a voluntary decision by the attacker, or an ongoing dispute over the remaining balance. The unconfirmed status of the transaction means it could potentially be modified or abandoned before final settlement.
Security and Recovery Questions
The incident underscores persistent vulnerabilities in sidechain security infrastructure. Liquid, which operates as a pegged sidechain to Bitcoin and is used primarily for asset issuance and faster transactions, has not disclosed details of how the breach occurred or what measures are being taken to prevent similar exploits.
Why It Matters
For Traders
Uncertainty about whether the transaction will confirm and whether further negotiations might shift the split creates near-term volatility in wrapped BTC positions on Liquid.
For Investors
A major sidechain suffering a breach and retaining attacker-friendly outcomes raises questions about the security model and governance effectiveness of pegged sidechains as Bitcoin infrastructure.
For Builders
The incident demonstrates that existing Liquid security assumptions may be weaker than assumed; projects building on Liquid should re-evaluate their risk model and consider alternative chains.
This article is for information only and is not financial advice. Read the full disclaimer.
