The Liquid Network has officially announced that its systems are up and running again, marking a significant milestone over one month after hackers stole 4,000 bitcoin—valued at approximately $320 million at the time—from the network’s federation wallet. In a dramatic turn of events that gripped the cryptocurrency community, the attackers ultimately returned the vast majority of the funds in what was described as a "white hat" operation, though lingering controversies over retained funds and harsh ransom demands continue to surround the incident.
Writing in an official blog post published on Tuesday, the Liquid Network stated that it was entering "the final stages of recovery with enhanced security." The security breach, which occurred in September, targeted the federation wallet backing the Blockstream sidechain. Following the theft, Blockstream engaged in intense negotiations with the hackers, successfully securing the return of most of the stolen assets.
Detailing the final steps of the restoration process, the Liquid blog post explained that the procedure involves reestablishing the network’s full 1:1 bitcoin backing, followed by the controlled reactivation of Federation peg-outs for authorized PAK key holders. "The Federation, Blockstream, and independent security experts have made substantial progress toward this objective, with the necessary technical infrastructure and safeguards now in place," the post read.
As part of the phased restoration, the network has successfully reintroduced phased swaps. Blockstream CEO Adam Back confirmed the development on the social media platform X on Tuesday, writing that swaps were working again for users.
The Liquid Network is a prominent layer-2 sidechain created by Blockstream designed to allow users to quickly move assets backed 1:1 with bitcoin. The platform enables participants to seamlessly swap stablecoins for bitcoin, as well as interact with bitcoin on the Lightning Network through supported third-party applications.
The initial breach was executed when hackers exploited an inflation bug on the Liquid sidechain. This vulnerability allowed them to artificially create over 4,000 LBTC—a token supposedly backed 1:1 by bitcoin—that did not exist prior to the exploit. The perpetrators then cashed out these fraudulent tokens for real, on-chain BTC, draining the federation reserves.
What followed was an extraordinary communication channel opened between the hackers and Blockstream via messages embedded directly into Bitcoin blocks. The hackers claimed to be white-hat operators acting to expose severe security flaws, but their methods quickly sparked intense debate within the crypto industry. Critics have strongly argued that the attackers cannot be considered traditional white hats because they opted to keep a substantial portion of the stolen funds.
During their blockchain-based negotiations, the hackers did not hold back their frustration, slamming Blockstream as "delusional, greedy, and arrogant" in one of their public messages. The attackers went so far as to threaten the company, warning that they would release all of Blockstream’s encrypted messages from their exchange unless the firm paid an additional 10% of the bitcoins as an official bounty.
"You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess," the hackers warned in the message.
Despite returning the bulk of the assets, public records indicate that the hackers are still holding onto approximately 600 bitcoins—amounting to roughly 15% of the total funds stolen. At current market prices, the retained stash is worth close to $50 million. To date, it remains unclear whether Blockstream has reached any private settlement with the hackers regarding these remaining funds, as the company focuses on completing its security overhaul and restoring full operational capacity to the network.
