The Liquid Network announced on Tuesday that its infrastructure is fully up and running again, marking a major milestone over a month after hackers made off with 4,000 bitcoin. At the time of the September breach, the stolen funds were valued at approximately $320 million. The incident unfolded when the perpetrators drained the network’s federation wallet before later returning the vast majority of the assets in what was described as a "white hat" operation, though the aftermath has left lingering questions regarding negotiations and the ethical boundaries of the hackers’ actions.
In a detailed blog post published on Tuesday, the Liquid Network stated that it was officially entering "the final stages of recovery with enhanced security." The security overhaul follows the September breach, which targeted the federation wallet backing the Bitcoin sidechain developed by Blockstream. While the initial theft sent shockwaves through the ecosystem, Blockstream was subsequently able to negotiate the return of the lion’s share of the digital assets.
Outlining the steps required to restore absolute normalcy, the Liquid blog post explained that the final phase of restoration involves reestablishing the network’s full 1:1 bitcoin backing. This crucial step is being followed by the controlled reactivation of Federation peg-outs for authorized PAK key holders.
"The Federation, Blockstream, and independent security experts have made substantial progress toward this objective, with the necessary technical infrastructure and safeguards now in place," the Liquid blog post read.
Complementing the platform’s operational updates, the network confirmed that it has successfully reintroduced phased swaps. Providing real-time confirmation to the broader crypto community, Blockstream CEO Adam Back took to the social media platform X on Tuesday to write that swaps were officially working again.
For context, the Liquid Network is a prominent layer-2 scaling and settlement network created by Blockstream. It is designed to allow users to quickly and confidentially move assets backed 1:1 with bitcoin. Within this ecosystem, participants can seamlessly swap stablecoins for bitcoin, as well as interact with bitcoin on the Lightning Network via various applications that provide support for the Liquid Network.
The mechanism behind the September attack targeted the core structural integrity of the sidechain. Hackers were able to acquire the 4,000 bitcoins by exploiting an inflation bug on the Liquid sidechain. By weaponizing this vulnerability, the attackers managed to mint over 4,000 LBTC—a token supposedly backed 1:1 by bitcoin—that did not exist prior to the exploit. They then proceeded to cash out these newly minted tokens for real, authentic on-chain BTC.
Following the extraction of the funds, a bizarre communications saga played out across the blockchain. The hackers publicly claimed to be white hat operators and engaged in an extraordinary exchange with Blockstream via messages permanently inscribed directly into Bitcoin blocks. However, this designation has been heavily contested by critics and industry observers, who point out that the self-proclaimed white hats retained roughly 15% of the stolen funds, translating to tens of millions of dollars.
During the course of these on-chain negotiations, the tension between Blockstream and the hackers escalated visibly. In one particularly contentious message, the hackers launched a scathing attack against Blockstream, slamming the company as "delusional, greedy, and arrogant." Furthermore, the perpetrators issued a direct ultimatum, threatening to publicly release all of Blockstream’s encrypted messages from their exchange unless the company agreed to pay the hackers an additional 10% of the bitcoins as an official bug bounty.
"You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess," the message read, laying bare the aggressive posture adopted by the actors holding the funds.
Despite the successful recovery of a substantial portion of the stolen treasury and the recent resumption of normal network operations, financial loose ends remain. According to the latest public knowledge, the hackers are still holding onto approximately 600 bitcoins, representing 15% of the total funds originally compromised. At current market valuations, this remaining stash is worth close to $50 million. At present, it remains entirely unclear whether Blockstream has managed to reach a private settlement with the hackers regarding these remaining funds, or if the situation will see further developments as the network moves past its security crisis.
