Liquid

Moola Market

2026

Dubai

Bitcoin

<p><strong>The actors behind the Liquid Network security incident have returned 3,400 BTC to the Liquid Federation wallet while retaining roughly 600 BTC, according to September 7, 2026 reporting, leaving the sidechain paused and its reserves unreconciled even as Bitcoin trades near $79,300 amid a broader risk-on tape.</strong></p>
<p>The partial return, first surfaced by Decrypt and Bitcoin.com News, follows Liquid Network's September 6 acknowledgment that purported "white-hat" actors withdrew approximately 4,000 BTC, valued at roughly $320 million, from the Liquid Federation wallet, <a href="https://x.com/Liquid_BTC/status/2096696272447218108" rel="noopener noreferrer nofollow">per the protocol's own incident announcement</a>. This is a sidechain incident tied to Blockstream's Liquid Network, not the 2021 breach of the separately owned Liquid exchange. For related coverage, see <a href="https://www.coincu.com/liquid-hackers-return-3400-btc-retain-598-5-btc/" rel="noopener noreferrer nofollow">Liquid Hackers Return 3,400 BTC, Retain About 598.5 BTC</a>.</p>
<p>What is confirmed is narrow: two independent outlets report the same 3,400 BTC return and a residual balance near 600 BTC, while the on-chain leg cited by that reporting could not be independently validated. What remains conditional is nearly everything downstream, from the transaction's confirmation status to whether the retained coins reflect an agreed reward. For related coverage, see <a href="https://www.coincu.com/polynext-awards-conference-dubai-2026-advancing-the-global-dialogue-on-plastic-recycling-and-circularity/" rel="noopener noreferrer nofollow">PolyNext Awards &amp;amp; Conference Dubai 2026: Advancing the Global Dialogue on Plastic Recycling and Circularity</a>.</p>
<h2 id="liquid-attacker-returns-3-400-btc-in-a-partial-recovery">Liquid attacker returns 3,400 BTC in a partial recovery</h2>
<p>Decrypt and Bitcoin.com News both reported on September 7 that the actors sent 3,400 BTC back to the Liquid Federation wallet, a return corroborated across the two outlets even though independent blockchain confirmation was unavailable, <a href="https://decrypt.co/377600/liquid-hackers-return-270m-bitcoin" rel="noopener noreferrer nofollow">according to Decrypt's incident summary</a>. For related coverage, see <a href="https://www.coincu.com/ainext-awards-conference-dubai-2026-where-ai-leaders-innovators-and-decision-makers-shape-the-future-of-artificial-intelligence/" rel="noopener noreferrer nofollow">AINext Awards &amp;amp; Conference Dubai 2026: Where AI Leaders, Innovators and Decision-Makers Shape the Future of Artificial Intelligence</a>.</p>
<figure style="margin:24px 0;padding:24px;border:1px solid #d1d5db;border-left:5px solid #075985;border-radius:8px;background:#ffffff;color:#111827;font-family:Arial,Helvetica,sans-serif">
 <div style="margin:0 0 10px;font-size:16px;line-height:1.4;font-weight:700">
  Liquid Network: BTC reportedly returned
 </div>
 <p style="margin:0 0 12px;font-size:36px;line-height:1.2;font-weight:700">3,400 BTC</p>
 <figcaption style="margin:0;font-size:14px;line-height:1.6;color:#4b5563">
  Decrypt and Bitcoin.com News reported on September 7, 2026 that 3,400 BTC were returned to the Liquid Federation wallet. Transaction outputs and confirmation status were not independently verified.
 </figcaption>
</figure>
<p>The reporting is the supplied basis for the figure, not an independent on-chain readout: the <a href="https://mempool.space/tx/a6d697a25266ce3c78774fd1d75f896b7af522ada209b0f6228ea497bc49a46d" rel="noopener noreferrer nofollow">Bitcoin transaction linked to the return</a> resolved only to a JavaScript application shell when fetched, leaving its outputs and confirmation count unverified. Treat the return as corroborated reporting, not as a settled, final transfer.</p>
<p>The dynamic mirrors prior "return" episodes such as when the <a href="https://www.coincu.com/moola-market-attacker-returns/" rel="noopener noreferrer nofollow">Moola Market attacker sent back 93% of the exploited crypto</a>, where a headline recovery percentage preceded any full reconciliation of losses.</p>
<h2 id="about-600-btc-still-sit-with-the-actors">About 600 BTC still sit with the actors</h2>
<p>The residual balance is where the two outlets diverge in precision: Bitcoin.com News reported the actors retained <a href="https://news.bitcoin.com/liquid-hackers-return-3400-btc-keep-47m-as-network-stays-frozen/" rel="noopener noreferrer nofollow">598.49955894 BTC</a>, while Decrypt described the remainder as approximately 598.5 BTC, or about 600 BTC in round terms.</p>
<figure style="margin:24px 0;padding:24px;border:1px solid #d1d5db;border-left:5px solid #92400e;border-radius:8px;background:#ffffff;color:#111827;font-family:Arial,Helvetica,sans-serif">
 <div style="margin:0 0 10px;font-size:16px;line-height:1.4;font-weight:700">
  Liquid Network: BTC reportedly retained
 </div>
 <p style="margin:0 0 12px;font-size:36px;line-height:1.2;font-weight:700">≈598.5 BTC</p>
 <figcaption style="margin:0;font-size:14px;line-height:1.6;color:#4b5563">
  Decrypt reported approximately 598.5 BTC retained, or about 600 BTC. Bitcoin.com News reported 598.49955894 BTC. These September 7, 2026 figures are attributed reporting, not an independently verified current wallet balance or an established reserve shortfall.
 </figcaption>
</figure>
<h3 id="returned-and-unreturned-btc-at-a-glance">Returned and unreturned BTC at a glance</h3>
<p>The reported 3,400 BTC return set against roughly 600 BTC retained implies a combined figure near 4,000 BTC, an approximate calculation derived from the two reported amounts rather than a verified original loss. That derived total aligns with the protocol's own approximate ~4,000 BTC withdrawal figure, though the components have not been reconciled from transaction data.</p>
<p>On the same derived basis, the return represents roughly 85% of the implied total, leaving about 15% outstanding, percentages that are approximate calculations from the reported figures and not an audited reserve position. The retained amount is not an independently checked current wallet balance and may have shifted after publication.</p>
<h2 id="why-a-reported-return-is-not-a-completed-recovery">Why a reported return is not a completed recovery</h2>
<p>Blockstream signaled the return was preconditioned on a fix: Decrypt reported the company sent a signed on-chain message stating its bridge nodes had been patched before the 3,400 BTC transfer moved. That sequencing frames the return as remediation-gated, yet a patch message does not by itself establish that reserves are whole.</p>
<h3 id="partial-recovery-and-customer-backing">Partial recovery and customer backing</h3>
<p>The headline development is an asset return, not a resumption of service. As of the September 7 reports, Liquid remained paused, bridge nodes were disabled, and normal L-BTC deposit and withdrawal operations had not resumed, according to Bitcoin.com News. A returned tranche of coins does not, on its own, establish that L-BTC backing has been restored or that holders have been made whole.</p>
<p>Nor is the retained balance established as an agreed bounty. Liquid said federation keys were not compromised and SideSwap said its systems were not breached, with the technical account instead pointing to an Elements range-proof verification cache bug, a root cause that remains attributed reporting pending a fetched postmortem. That distinction matters, echoing the earlier stage when a <a href="https://www.coincu.com/liquid-white-hat-hacker-bitcoin-return-vulnerability-fix/" rel="noopener noreferrer nofollow">Liquid actor pledged to return Bitcoin after a fix</a> was applied.</p>
<p>Ledger Chief Technology Officer Charles Guillemet publicly disputed the white-hat framing on September 7, acknowledging the refund while questioning whether retaining 600 BTC could fairly be called white-hat work.</p>
<blockquote class="twitter-tweet" style="margin:20px 0;padding:16px 18px;background:#1a1a0d;color:#f3f4f6;border:1px solid #f7931a;border-radius:12px;margin:20px 0;padding:16px 18px;background:#1a1a0d;color:#f3f4f6;border:1px solid #f7931a;border-radius:12px">
 <p>So, 3,400 BTC were refunded. The “white hats” still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking! <br>Let's see what happens to these 600 BTC... <a rel="noopener noreferrer nofollow" href="https://t.co/nb1p9COmBk">https://t.co/nb1p9COmBk</a><a rel="noopener noreferrer nofollow" href="https://t.co/BBKLrMVsqd">pic.twitter.com/BBKLrMVsqd</a></p>— Charles Guillemet (@P3b7_) <a rel="noopener noreferrer nofollow" href="https://x.com/P3b7_/status/2096998672206647806?ref_src=twsrc%5Etfw">September 7, 2026</a>
</blockquote>
<p style="text-align:center;color:#888;font-size:13px">Source: @P3b7_ on X</p>
<p>His characterization is opinion questioning the actors' motive, not proof that a negotiated agreement or any criminal finding exists. Decrypt reported the actors had not publicly explained why they retained the remainder, and that Blockstream had not immediately responded to its request for comment.</p>
<h2 id="details-still-needed-to-assess-the-liquid-recovery">Details still needed to assess the Liquid recovery</h2>
<p>The missing evidence is specific rather than vague. No independently readable transaction payload or confirmation count was available, and the exact receiver address, transfer timestamp, and transfer-time USD value of the return remain unverified against explorer data.</p>
<h3 id="transaction-confirmation-and-recipient-details">Transaction confirmation and recipient details</h3>
<p>The open items that would upgrade this from reported to verified include the return's timing, an independently confirmed transaction record, recipient confirmation of the Liquid Federation wallet, and a reconciliation separating the rounded ~4,000 BTC figure, miner fees, service costs, the return output, and the retained coins. None of the fetched reporting supplies that full reconciliation.</p>
<p>The supplied context also provides no plan or deadline for the remaining coins; the absence of a stated timeline in the fetched reports should not be read as evidence that no such records or plans exist. The market backdrop is unremarkable relative to the incident: Bitcoin traded near <a href="https://www.coingecko.com/en/coins/bitcoin" rel="noopener noreferrer nofollow">$79,334</a>, down about 0.58% over 24 hours as of September 7, a move not attributable to this event, while the broad-market <a href="https://alternative.me/crypto/fear-and-greed-index/" rel="noopener noreferrer nofollow">Fear &amp; Greed Index</a> read 71, or "Greed," a market-wide gauge that does not measure reaction to the Liquid incident.</p>
<h2 id="faq-liquid-attacker-btc-return">FAQ: Liquid attacker BTC return</h2>
<h3 id="how-much-btc-did-the-liquid-attacker-return">How much BTC did the Liquid attacker return?</h3>
<p>3,400 BTC, according to September 7, 2026 reporting from Decrypt and Bitcoin.com News, which corroborate the figure even though the on-chain transfer was not independently verified.</p>
<h3 id="how-much-btc-remains-unreturned">How much BTC remains unreturned?</h3>
<p>About 600 BTC. Bitcoin.com News reported a precise 598.49955894 BTC retained, while Decrypt described roughly 598.5 BTC.</p>
<h3 id="has-all-the-btc-been-returned">Has all the BTC been returned?</h3>
<p>No. The reporting indicates about 600 BTC remains outstanding, and Liquid stayed paused with bridge nodes disabled as of September 7.</p>
<h3 id="when-will-the-remaining-btc-be-returned">When will the remaining BTC be returned?</h3>
<p>No timeline is provided in the supplied reporting, and the actors had not publicly explained why they retained the remainder.</p>
<p>The next concrete trigger to watch is a fetched Liquid or Blockstream postmortem or an independently confirmed on-chain reconciliation, either of which would move the retained ~598.5 BTC and the Elements cache-bug account from attributed reporting toward verified fact, alongside any signed statement on whether the network's L-BTC backing has been restored before deposits and withdrawals resume.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p>
<p>The post <a href="https://www.coincu.com/liquid-attacker-returns-3400-btc-600-btc-unreturned/" rel="noopener noreferrer nofollow">Liquid Attacker Returns 3,400 BTC; About 600 BTC Unreturned</a> was initially published on <a href="https://coincu.com/" rel="noopener noreferrer nofollow">Coincu</a>.</p>

Liquid Attacker Returns 3,400 BTC; About 600 BTC Unreturned

Table of Contents

Coincu

Other articles published on Sep 7, 2026

Join our free newsletter for daily crypto updates!