Liquid's federation wallet received 3,400 BTC back after a major reserve drain but user withdrawals remain frozen and public bridge nodes are still down, leaving holders in limbo over the status of their Bitcoin-backed tokens
Liquid's Bitcoin sidechain is still reeling after a dramatic reserve drain, with 3,400 BTC returned to its federation wallet but no clear path for users to redeem their tokens. The partial recovery, confirmed on September 7, has not restored normal operations or resolved the fate of nearly $47 million in Bitcoin that remains with the hackers.
Funds Returned but Access Blocked
The most visible development came when the self-identified white-hat hackers sent 3,400 BTC back to the Liquid federation address, following an on-chain message stating they were "sending most back" and asking, "is that ok." The transaction, recorded in Bitcoin block 965950, left approximately 598.5 BTC-worth about $47 million at the time-still under the hackers' control. There is no public evidence that this retained amount was an agreed bounty or part of a formal negotiation.
Despite the return, Liquid's public bridge nodes remain offline, and Blockstream's status page continues to list a major outage and active security incident. Users holding L-BTC, the Bitcoin-linked token on Liquid, are unable to redeem their tokens for actual Bitcoin until the federation reopens withdrawal services and reconciles reserves. The project's documented process requires burning L-BTC to release Bitcoin, but this mechanism is currently inaccessible for ordinary users.
Patch Claims and Ongoing Outage
Prior to the recovery, an on-chain message claimed that bridge nodes had been patched and that funds were safe to return. The message's signature reportedly verified against Blockstream's security key, but this technical assertion does not guarantee that withdrawal services are operational or that all vulnerabilities have been addressed. Exchanges and services that support L-BTC have paused deposits and withdrawals, with platforms like @side_swap explicitly instructing users not to attempt new peg-ins or peg-outs until further notice.
As of September 8, Blockstream's dashboard still showed the bridge outage, and no timeline has been provided for restoring full access. The lack of transparency around reserve reconciliation and operational status leaves L-BTC holders with unresolved questions about the safety and liquidity of their assets.
Reserve Accounting and User Impact
CryptoSlate previously estimated the original outflow at around 3,996 BTC, while the recovery transaction spent approximately 3,998.5 BTC from the hacker-controlled address. The 3,400 BTC returned to the federation wallet increases the assets backing L-BTC, but does not by itself confirm that all outstanding tokens are fully backed or that users can redeem them at par. Full reserve accounting will require reconciling the returned funds with the total legitimate L-BTC supply and confirming that all operational controls are restored.
This incident echoes patterns seen in other high-profile cross-chain exploits, such as those reported earlier, where partial recoveries and technical fixes do not immediately translate into restored user confidence or access. The ongoing outage and lack of clear communication from the federation have left users in a holding pattern, unable to access their Bitcoin or trust the system's current security posture.
Market Data and Security Context
At the time of the incident, the 3,400 BTC returned to the Liquid federation wallet represented a value of over $267 million, based on prevailing market prices. The 598.5 BTC retained by the hackers was worth approximately $47 million. The recovery transaction was confirmed at 16:09:25 UTC on September 7 in Bitcoin block 965950. As of September 8, the Liquid network's public bridge nodes remained offline, and no official statement had confirmed the reopening of withdrawal services or the completion of reserve reconciliation.
Liquid's ongoing outage highlights the operational and security risks inherent in federated sidechains and cross-chain bridges. Unlike Bitcoin's base layer, which relies on decentralized mining and transparent consensus, Liquid's model depends on a federation of authorized members to manage reserves and process redemptions. This structure introduces additional trust assumptions and potential single points of failure, especially when bridge infrastructure is compromised or disabled. For users, the inability to redeem L-BTC for Bitcoin during an incident exposes the practical limitations of wrapped assets and the importance of robust operational controls and transparent incident response.
