The Liquid Network announced on Tuesday that its operations are officially up and running again, marking a major milestone just over one month after hackers stole 4,000 bitcoin—valued at approximately $320 million at the time—from the network’s federation wallet. The vast majority of the funds have since been returned in what was initially described as a "white hat" operation, though the aftermath of the incident has left lingering questions regarding accountability, security, and the true motivations of the individuals behind the breach.
Writing in an official blog post published on Tuesday, the Liquid Network stated that it is now entering "the final stages of recovery with enhanced security." The incident began in September, when attackers managed to breach the federation wallet that backs the Blockstream sidechain, executing one of the most significant exploits in the ecosystem’s history. Following the initial theft, Blockstream engaged in intense negotiations with the hackers, ultimately managing to recover a substantial portion of the stolen assets.
Detailing the path forward, the Liquid blog post explained the technical steps required to achieve total normalization. "The final phase of restoration involves reestablishing the network’s full 1:1 bitcoin backing, followed by the controlled reactivation of Federation peg-outs for authorized PAK key holders," the post read. The administration emphasized that the Federation, Blockstream, and a team of independent security experts have made substantial progress toward this vital objective, ensuring that the necessary technical infrastructure and robust safeguards are now securely in place.
As part of this gradual return to normalcy, the network has successfully reintroduced phased swaps. Blockstream CEO Adam Back took to social media platform X on Tuesday to confirm the development, writing simply and directly that swaps were working again for users.
For context, the Liquid Network is a prominent layer-2 sidechain created by Blockstream that enables users to execute rapid, confidential transactions and move assets backed 1:1 with bitcoin. The infrastructure allows participants to seamlessly swap stablecoins for bitcoin, as well as interact with bitcoin on the Lightning Network across various supporting applications and platforms.
The mechanism behind the September exploit targeted the core architecture of the sidechain. Hackers were able to acquire the 4,000 bitcoins by exploiting an inflation bug present within the Liquid sidechain. This vulnerability allowed them to mint over 4,000 LBTC—a token supposedly backed 1:1 by bitcoin—that did not exist prior to the exploit. Once the unauthorized tokens were generated, the attackers were able to cash them out for real, native on-chain BTC.
What followed the exploit was a bizarre and contentious public standoff. The perpetrators claimed to be white hat hackers acting in the interest of network security. They communicated with Blockstream through a series of unusual messages permanently embedded directly into Bitcoin blocks, establishing a public ledger of their negotiations. However, this designation quickly drew sharp criticism from industry observers and security experts who argued that the hackers could hardly be considered benevolent "white hats," given that they chose to retain a lucrative 15% cut of the stolen funds, amounting to tens of millions of dollars.
The tensions spilled over into aggressive public threats during the on-chain negotiations. In one striking message, the hackers slammed Blockstream’s leadership, branding the company as "delusional, greedy, and arrogant." They escalated the pressure by threatening to publicly release all of Blockstream’s encrypted messages from their private exchange unless the company conceded to their financial demands and paid them an additional 10% of the bitcoins as an official bug bounty.
"You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess," the hackers’ on-chain message read, highlighting the high-stakes leverage they held over the protocol and its user base.
Despite the recovery of most funds and the gradual reactivation of network services, the situation remains financially unresolved in certain aspects. Public records and the latest available information indicate that the hackers are still holding onto approximately 600 bitcoins, representing 15% of the total funds originally taken. At current market valuations, this retained portion is worth close to $50 million. At present, it remains unclear whether Blockstream has managed to reach a private settlement with the hackers to recover the remaining balance, or if those funds remain permanently out of reach.
