The address that drained Blockstream's Liquid Network federation wallet on Sunday has broadcast a transaction sending 3,400 BTC back while keeping 598.49955894 BTC for itself. The return followed a negotiation conducted entirely through on-chain Bitcoin messages, and Liquid's bridge nodes remain disabled as operators work to restore the peg.
The transaction pays 3,400 BTC, worth about $268 million, back to the federation address, while sending 598.49955894 BTC, about $47.2 million, to the address that took it. That is 15% of the 3,998.50 BTC withdrawn from Liquid's reserves. The transaction carries a fee of 1,768 satoshis and remained unconfirmed at 15:50 UTC on Monday, with all 16 inputs flagged replace-by-fee.
An On-Chain Negotiation
Blockstream opened contact on Sunday at 19:31 UTC, asking the attacker to reach out by email. The attacker replied in the clear early Monday, offering to send most of the funds back. Blockstream answered with a PGP-signed message. According to The Defiant: "Yes, thank you." A second signed message followed at 11:46 UTC saying bridge nodes were patched and it was safe to return the funds, after which the 3,400 BTC transaction appeared.
An Elements Bug, Not a Stolen Key
The incident traced back to a flaw in Elements, the Bitcoin Core fork that Liquid nodes run, rather than a compromised key. SideSwap said a customer sent 4,000 L-BTC to its peg-out service, which it processed normally before the Liquid Federation paid out bitcoin in return. Independent technical reconstructions point to a range-proof verification cache bug that apparently allowed unbacked L-BTC to be created on the Liquid sidechain. An earlier 2.5 BTC transaction served as a dry run before the larger peg-out followed.
Liquid's Peg Remains Short
Liquid's federation wallet would hold 3,597.47 BTC if the return confirms, against 197.30 BTC of outstanding L-BTC still owed. Bridge nodes stay disabled, so no new transactions reach the network, and L-BTC deposits and withdrawals at centralized exchanges remain halted. Other Liquid-issued assets, including USDT and real-world assets, were not touched, and Bitcoin's main network was unaffected. Bitcoin traded at $78,855, down 0.90% over 24 hours.
A restart may follow once operators confirm legitimate L-BTC is backed one-to-one and distribute a patched Elements release. Until then, roughly 598.5 BTC stays under the attacker's control with no published agreement on its return.
Sources: The Defiant, Bitcoin News
Trading involves risk.
Risk Disclaimer
