Hackers returned 3,400 Bitcoin to the Liquid network on Monday, roughly 85% of the 3,998 BTC they moved out over the weekend. The return came after Blockstream patched the bridge flaw that allowed the unauthorized transfer and confirmed via a signed Bitcoin transaction that funds were safe to send back. About 598.5 BTC, worth around $47 million at Monday's price near $79,100, remains in the attackers' address.
The return and its condition
The attackers set a clear condition for handing back the bulk of the haul: Blockstream had to fix the bridge vulnerability and ensure every node running the bridge was updated. Blockstream did both, then signed a transaction Monday morning to signal the all-clear. The company also shut off the bridge and asked exchanges to freeze L-BTC deposits and withdrawals while the fix was rolled out.
Blockstream has not said when service resumes or how it plans to cover the gap left by the missing coins. The remaining 598.5 BTC is still sitting in the address the attackers used, and there's no public timeline for its return.
How the bridge works
Liquid is a Bitcoin sidechain built by Blockstream. Users lock Bitcoin on the main network to receive L-BTC tokens, which move faster and support confidential transactions. Normally, moving Bitcoin out of the bridge requires sign-off from 11 of the 15 companies that run Liquid. This weekend's transfer went to a brand new address, bypassing that multi-signature process entirely. The Bitcoin network recorded the transfer in block 965,950 at 19:09 UTC.
White hat or extortion?
BeInCrypto reported Sunday that Liquid's peg still balanced after the outflow, and interpreted the attackers' notes as opening a negotiation rather than a theft. But not everyone is buying the white-hat label. Charles Guillemet, CTO at Ledger, questioned it, suggesting that holding back 600 BTC looks more like extortion than a clean ethical hack.
The distinction matters. White-hat hackers typically return everything and disclose vulnerabilities to help fix them. Keeping a six-figure cut, even as a “fee,” blurs that line and sets a messy precedent for how future exploits get resolved.
The immediate question is whether the remaining 598.5 BTC will come back, and if so, under what terms. Blockstream hasn't said whether it's negotiating or if it considers the case closed. Until the company announces a resumption date for the bridge and a plan for the missing coins, users are left waiting on an exchange that's still partially frozen.
