Hackers who stole $320 million in Bitcoin from the Liquid network have returned $270 million, leaving nearly 600 BTC outstanding. Blockstream, the company behind Liquid, sent an on-chain message to the attackers confirming that the network's bridge nodes have been patched.
The return
The return of the bulk of the stolen funds came after a period of silence from the attackers. On-chain data shows the $270 million was sent back to addresses controlled by Liquid. That leaves roughly 600 BTC — worth about $18 million at current prices — still in the hands of the hackers.
It's not clear what prompted the return. The attackers haven't issued a statement, and there's no public record of a ransom demand being met. The move is unusual; most major exchange hacks end with the funds vanishing into mixers or being laundered through privacy coins.
Blockstream's on-chain note
Blockstream didn't rely on press releases to communicate with the hackers. Instead, the company sent a message directly on the Bitcoin blockchain, addressed to the attackers. The message stated that Liquid's bridge nodes had been patched, a technical detail that suggests the vulnerability used in the heist has been closed.
On-chain messages are a common way for exchanges to talk to hackers, but they're usually terse. This one was more specific, naming the exact component that was fixed. It's a signal that Blockstream is confident the attack vector is sealed.
The outstanding balance
The remaining 600 BTC is a fraction of the total haul, but it's still a significant sum. For Liquid, the priority now is recovering that last piece. The exchange has said it will continue to work with law enforcement and blockchain analytics firms to trace the funds.
Whether the hackers will return the rest is an open question. The fact that they sent back the majority suggests they may be willing to negotiate, or they may have simply decided the risk of holding stolen funds wasn't worth it. Either way, the clock is ticking on the outstanding balance.
