Liquid recovers 3,400 BTC after white-hat return

Actors who withdrew nearly 4,000 BTC from Liquid Network's federation wallet on Sunday returned exactly 3,400 BTC on Monday. Bitcoin Magazine (7 September 2026) reconstructed the return from public transactions and on-chain OP_RETURN messages.

This is on-chain recovery reporting, not a Blockstream press release confirming bounty terms. The leftover coins are an implied retention, not a Blockstream-announced bounty. The actors call themselves white hats. Critics call it theft or extortion.

The return transaction (id prefix bc49a46d) confirmed at 16:09 UTC on 7 September 2026, sending exactly 3,400 BTC to the labeled Liquid peg script address. About 598.5 BTC, about 15 percent and about $48 million at then prices, stayed at the holder address as an implied finder's fee.

Negotiation ran in the open first. A Blockstream-linked address pointed the holders to security@blockstream.com, then posted Electrum-encrypted and PGP-signed notes. A later clear-text note said bridge nodes are patched and it is safe to return the funds. The 3,400 BTC landed after that note.

Later encrypted traffic, as Bitcoin Magazine reads it, suggests Blockstream was unhappy about the 15 percent retention. The holders posted a sad-face emoji, which that write-up treats as a sign that talks on reducing the fee did not go well. What those encrypted messages said is not public.

Liquid's last official X account post still described Sunday's withdrawal of about 4,000 BTC via the SideSwap peg-out path, said the PAK was not compromised, said other assets were unaffected, and said the sidechain was paused. As of the Bitcoin Magazine piece, Liquid and Blockstream had not posted a new official statement specifically on the 3,400 BTC return. SideSwap said the L-BTC in the original peg-out came from an Elements bug.

Blockstream's status page still lists a Liquid Security Incident as active, with public bridge nodes affected. Official restart of the network and a statement on how the remaining 598.5 BTC hole is covered are still open. Finpresso's first-day piece on the about 4,000 BTC withdrawal covered the pause.

A paused peg is a different problem from a US charter letter such as OpenReserve's OCC approval or Revolut's. Sanctions risk on correspondent rails, as in Treasury's Golden Global Bank designation, is a third category.

If you hold L-BTC or rely on Liquid peg-outs, wait for an official Liquid or Blockstream restart notice and a clear statement on how the remaining about 598.5 BTC hole is covered before treating the network as back to normal.