Hackers Return 85% of Stolen Bitcoin from Last Week’s Bridge Attack
The Liquid hackers returned 3,400 Bitcoin on Monday, most of the roughly 3,998 BTC they moved out of the network over the weekend. Close to 598 BTC stayed behind.
Liquid is a Bitcoin sidechain built by Blockstream. Users lock Bitcoin on the main network and receive a matching token, L-BTC, that moves faster and more privately.
Blockstream Patched the Bridge Before the Coins Moved
The transfer followed a condition the attackers set themselves. They told Blockstream to fix the flaw first and make sure every node running the bridge had been updated.
Moving Bitcoin out of the bridge normally takes sign-off from 11 of the 15 companies that run Liquid. The weekend transfer went to a brand new address instead.
Blockstream responded within a Bitcoin transaction on Monday morning, signing the message so recipients could verify it came from the company. The bridge nodes were patched, it said, and the funds were safe to send back.
The coins moved hours later. Bitcoin’s network recorded the transfer in block 965,950 at 19:09 UTC.
Nearly 600 Bitcoin Is Still With the Liquid Hackers
About 598.5 BTC remains in the attackers’ address, worth roughly $47 million at Monday’s Bitcoin price near $79,100. Neither side has explained why.
That silence is what bothers Charles Guillemet, chief technology officer at hardware wallet maker Ledger, who had already questioned the white hat label on Sunday.
So, 3,400 BTC were refunded. The “white hats” still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!
— Charles Guillemet (@P3b7_) September 7, 2026
Let's see what happens to these 600 BTC… https://t.co/nb1p9COmBk pic.twitter.com/BBKLrMVsqd
Follow us on X to get the latest news as it happens
BeInCrypto reported on Sunday that Liquid’s peg still balanced after the outflow, and read the attackers’ notes as the opening of a negotiation rather than a theft. That call proved close.
Blockstream shut off the bridge and asked exchanges to freeze L-BTC deposits and withdrawals. It has not said when service resumes, or how it covers the gap the missing coins leave.