by Coinstrooper Crypto Articles
Quick Take
  • The Liquid hackers returned 3,400 Bitcoin on Monday, most of the roughly 3,998 BTC they moved out of the network over the weekend.
  • Liquid is a Bitcoin sidechain built by Blockstream.
  • Users lock Bitcoin on the main network and receive a matching token, L-BTC, that moves faster and more privately.
  • The transfer followed a condition the attackers set themselves.

What Happened

The Liquid hackers returned 3,400 Bitcoin on Monday, most of the roughly 3,998 BTC they moved out of the network over the weekend. Close to 598 BTC stayed behind.

Nearly 600 Bitcoin Is Still With the Liquid Hackers

The post Hackers Return 85% of Stolen Bitcoin from Last Week’s Bridge Attack appeared first on BeInCrypto.

Market Context

About 598.5 BTC remains in the attackers’ address, worth roughly $47 million at Monday’s Bitcoin price near $79,100. Neither side has explained why.

Why It Matters

Blockstream responded within a Bitcoin transaction on Monday morning, signing the message so recipients could verify it came from the company. The bridge nodes were patched, it said, and the funds were safe to send back.

Details

Liquid is a Bitcoin sidechain built by Blockstream. Users lock Bitcoin on the main network and receive a matching token, L-BTC, that moves faster and more privately.

Blockstream Patched the Bridge Before the Coins Moved

The transfer followed a condition the attackers set themselves. They told Blockstream to fix the flaw first and make sure every node running the bridge had been updated.

Moving Bitcoin out of the bridge normally takes sign-off from 11 of the 15 companies that run Liquid. The weekend transfer went to a brand new address instead.

The coins moved hours later. Bitcoin’s network recorded the transfer in block 965,950 at 19:09 UTC.

That silence is what bothers Charles Guillemet, chief technology officer at hardware wallet maker Ledger, who had already questioned the white hat label on Sunday.

Follow us on X to get the latest news as it happens

BeInCrypto reported on Sunday that Liquid’s peg still balanced after the outflow, and read the attackers’ notes as the opening of a negotiation rather than a theft. That call proved close.

Blockstream shut off the bridge and asked exchanges to freeze L-BTC deposits and withdrawals. It has not said when service resumes, or how it covers the gap the missing coins leave.