Liquid Network has recovered 3,400 BTC of the roughly 4,000 BTC drained from its federation wallet on September 6, but approximately 598 BTC — worth about $47 million — remains unreturned, according to updates shared by Blockstream chief strategy officer Samson Mow.

The attackers withdrew the funds from the federation wallet backing Liquid's L-BTC, the sidechain's pegged representation of Bitcoin. The wallet held roughly 4,200 BTC before the incident, leaving 197 BTC following the withdrawal. Because L-BTC is designed to be backed one-for-one by Bitcoin held in the federation, the exploit created an immediate collateral shortfall across the network.

Mow said Monday that discussions with the attackers are continuing over the remaining funds.

"Approximately 598 BTC remains outstanding, and Blockstream continues to engage with the white-hat hackers," Mow posted on X.

How did the exploit unfold?

Liquid, a Bitcoin sidechain developed by Blockstream and operated by a federation of crypto exchanges and miners, suffered the breach on a Sunday in early September. Attackers drained approximately 4,000 BTC — then worth about $320 million — from the federation wallet in what ranks among the largest Bitcoin-related security incidents of the year.

Liquid responded by:

• Disabling bridge nodes used for L-BTC transfers
• Pausing all network activity
• Asking exchanges to freeze L-BTC deposits and withdrawals

Other assets issued on Liquid, including Tether, were not affected.

What was the attackers' stance?

The attackers publicly identified themselves as white-hat hackers and stated they would return the funds once Liquid fixed the underlying vulnerability. The group transferred 3,400 BTC back to the federation wallet after Blockstream confirmed that the affected bridge nodes had been patched.

Why does the remaining 598 BTC matter?

The recovery significantly reduces the immediate backing shortfall, but the network still must complete security and operational work before reopening. Outstanding tasks cover:

• Completing additional security fixes
• Resolving a chain split created during the incident
• Restoring federation infrastructure
• Confirming L-BTC is fully backed before restarting

Mow separately warned users not to send Bitcoin to Liquid peg-in addresses until the network confirms an official restart.

How does Liquid's case compare to other crypto exploits?

The return of most of the stolen Bitcoin distinguishes the Liquid incident from many other major crypto exploits, where attackers attempt to move or launder funds after draining a protocol. August alone saw 50 major crypto hacks resulting in $136.3 million in losses, with infrastructure built around Bitcoin — rather than the Bitcoin base layer itself — increasingly targeted.

What happens next?

Liquid faces a more critical task than recovering the remaining Bitcoin: demonstrating that the vulnerability has been fully addressed and that the federation infrastructure is secure enough to resume operations. Until those steps complete and the chain split resolves, the network is expected to remain paused. The outstanding 598 BTC and the broader security investigation mean the incident is not yet closed, with no public timeline for L-BTC peg-in and peg-out services to resume.