Liquid Network Hackers Return $270M Bitcoin After Blockstream Patches Bug

Withdrawal, Return, and Ongoing Negotiations

Hackers withdrew roughly 4,000 BTC from the Liquid Network, valued at approximately $320 million. The attackers presented themselves as white hats, stating they would return most funds once Blockstream patched the vulnerability and deployed fixes across all nodes. Following Blockstream's node patching, the group returned approximately 3,400 BTC—valued at roughly $270 million—according to CoinDesk reporting. Nearly 600 BTC, worth approximately $47 million at current prices, remains outstanding, and negotiations are underway for its return.

Communication and Coordination

Blockstream communicated the completion of its patch to the actors through an on-chain message, signaling that Liquid's bridge nodes had been updated. The group's decision to return the bulk of the funds aligns with their stated conditional offer, though the reasons for retaining the remaining balance have not been publicly disclosed. The ongoing dialogue suggests both parties are working toward a full settlement.

Operational Impact and Timeline

The temporary removal and partial return of $320 million in BTC from Liquid disrupted sidechain liquidity during the interim period. The incident underscores coordination challenges inherent in sidechain security responses, where node operators across a federated network must deploy patches before resuming normal operations. Blockstream has not issued a detailed public statement on the vulnerability's scope or remediation methodology.