The Liquid network, a sidechain dedicated to Bitcoin, has seen a singular outcome following a major hack that put its reserves at risk. Less than 24 hours after the fraudulent theft of nearly 4,000 BTC, which represented the bulk of the platform's collateral, the perpetrator executed an unexpected turn of events by returning a large portion of the loot. This Monday, September 7, an on-chain transaction confirmed the transfer of 3,400 BTC to the Federation's official address, marking a key milestone in the resolution of this security breach.
The unfolding of this incident appears to mirror a "white hat" operation. Before proceeding with the refund, the attacker established a direct dialogue with the Blockstream teams, ensuring beforehand that the technical vulnerabilities that allowed the fund extraction were patched. After receiving signed confirmation from the network's technical leads, the individual executed the transfer of 85% of the stolen assets, closing this episode with a swift compromise that drastically limits potential losses for protocol users.
Despite this massive return, the fate of the remaining 600 BTC—roughly 15% of the initially diverted amount—remains a subject of intense speculation within the crypto community. At this stage, no official information has been released regarding the nature of this retention. It is difficult to determine whether these funds represent a "bounty" negotiated behind the scenes in exchange for network security, a unilateral cut kept by the hacker, or if a subsequent transfer is still to be expected. This uncertainty continues to fuel debates over vulnerability management in the decentralized ecosystem.
This incident once again highlights the critical security challenges faced by sidechains and Bitcoin scaling solutions. While the responsiveness of the technical teams and the partial restitution helped avoid a total financial disaster, the fragility exposed by this exploit serves as a reminder that trust in these infrastructures relies on constant vigilance. For Liquid, the immediate challenge is now to restore the full integrity of its "peg" system and regain user confidence following a sequence that could have durably paralyzed the project.