Liquid Network Enters Final Recovery Phase After 4,000 BTC Hack

The Liquid Network said on Tuesday it has entered the final stages of recovery, more than one month after hackers drained 4,000 bitcoin — roughly $320 million at the time — from the federation wallet backing the Blockstream-built sidechain.

In a blog post, the network said it was entering "the final stages of recovery with enhanced security." The September incident saw attackers exploit an inflation bug on the sidechain to mint more than 4,000 LBTC, a token meant to be backed 1:1 with bitcoin, and cash the fabricated tokens out for real on-chain BTC.

"The final phase of restoration involves reestablishing the network's full 1:1 bitcoin backing, followed by the controlled reactivation of Federation peg-outs for authorized PAK key holders," the post read. "The Federation, Blockstream, and independent security experts have made substantial progress toward this objective, with the necessary technical infrastructure and safeguards now in place."

What has reopened so far?

Liquid, a layer-2 network created by Blockstream, lets users move assets backed 1:1 with bitcoin, swap stablecoins for bitcoin, and exchange coins across the Lightning Network on supporting applications.

The network has reintroduced phased swaps. Blockstream CEO Adam Back confirmed on X on Tuesday that LBTC-to-BTC swaps had returned to full service, including mainchain swaps via SideSwap and Lightning swaps through Aqua Bitcoin.

Who took the funds — and how much remains?

The attackers described themselves as white hat hackers and negotiated with Blockstream through messages embedded directly in Bitcoin blocks. The two sides eventually agreed to terms, and Blockstream recovered the majority of the funds.

The negotiation was not gentle. In one on-chain message, the hackers called Blockstream "delusional, greedy, and arrogant" and threatened to publish all of the company's encrypted messages from the exchange unless it paid 10% of the bitcoin as an official bounty.

"You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess," the message read.

Critics have questioned the white hat label, pointing out that the hackers retained 15% of the stolen funds. They still hold approximately 600 bitcoin — about 15% of the total — worth close to $50 million at current prices, according to the latest public knowledge.

What happens next?

The recovery sequence now depends on two milestones: restoring full 1:1 bitcoin backing for LBTC in circulation, then reactivating Federation peg-outs for authorized PAK key holders under controlled conditions. Whether Blockstream reached a private settlement with the hackers remains unknown, leaving open the possibility of further movement on the remaining 600 BTC.