Actors claiming to be white hat hackers returned 3,400 bitcoin to Liquid Network on September 7, one day after an exploit drained the sidechain bridge, according to a post on X. The recovered funds are valued at approximately $268 million at current prices. A separate transfer moved 598.5 BTC, worth roughly $47 million, to a different address.
Liquid is a sidechain operated by Blockstream that allows users to move bitcoin and other assets between chains with faster settlement times and greater privacy than the main chain. The September 6 exploit exposed a vulnerability in the bridge's security model. The recovery of 96 percent of the total drained amount in under 24 hours is unusual in bridge exploits, where funds are typically considered lost permanently once moved off-chain.
The 598.5 BTC that remains in the separate address has not been claimed by Blockstream or other network operators. Lookonchain, a blockchain tracking service, said in its analysis that the retained amount could represent compensation the actors negotiated for identifying and disclosing the vulnerability. Blockstream has not publicly confirmed whether those funds were offered as a bounty or remain in limbo pending further negotiation.
Bridge exploits have been a persistent vector for losses in crypto infrastructure over the past three years. Wormhole lost $325 million in February 2022 before the attacker returned the full amount; Ronin suffered a $625 million theft in March 2022 that took longer to recover. The speed of the Liquid recovery and the actors' choice to return the majority of funds distinguishes this incident from those precedents.
Blockstream has not disclosed the technical details of the vulnerability or confirmed the identity of the returning actors. The company said on X that it was investigating the incident and working with security researchers. The Liquid Network has processed approximately $35 billion in value transfers annually and serves as infrastructure for several cryptocurrency trading venues and custody providers.
The 598.5 BTC held at the separate address has not moved since September 7. If Blockstream does not resolve the status of those funds within 30 days, pressure may mount on the network to formally acknowledge whether a bounty was agreed or if the coins remain stolen property pending extended negotiation.
