Liquid recovers 3,400 BTC after white-hat return

Actors who withdrew nearly 4,000 BTC from Liquid Network's federation wallet on Sunday returned exactly 3,400 BTC on Monday. Bitcoin Magazine reconstructed the return on 7 September 2026 from public transactions and on-chain OP_RETURN messages.

The leftover coins are an implied retention, not a Blockstream-announced bounty. The actors call themselves white hats. Critics call it theft or extortion. Bitcoin Magazine's reconstruction is on-chain recovery reporting, not a Blockstream press release confirming bounty terms.

The return transaction (id prefix bc49a46d) confirmed at 16:09 UTC on 7 September 2026, sending exactly 3,400 BTC to the labeled Liquid peg script address. About 598.5 BTC, about 15 percent and about $48 million at then prices, stayed at the holder address as an implied finder's fee.

Negotiation ran in the open first. A Blockstream-linked address pointed the holders to [email protected], then posted Electrum-encrypted and PGP-signed notes. A later clear-text note said bridge nodes are patched and it is safe to return the funds. The 3,400 BTC landed after that note.

Later encrypted traffic, as Bitcoin Magazine reads it, suggests Blockstream was unhappy about the 15 percent retention. The holders posted a sad-face emoji, which that write-up treats as a sign that talks on reducing the fee did not go well. What those encrypted messages said is not public.

Liquid's last official X account post still described Sunday's withdrawal of about 4,000 BTC via the SideSwap peg-out path, said the PAK was not compromised, said other assets were unaffected, and said the sidechain was paused. As of the Bitcoin Magazine piece, Liquid and Blockstream had not posted a new official statement specifically on the 3,400 BTC return. SideSwap said the L-BTC in the original peg-out came from an Elements bug.

Blockstream's status page still lists a Liquid Security Incident as active, with public bridge nodes affected. Official restart of the network and a statement on how the remaining 598.5 BTC hole is covered are still open. Finpresso's first-day piece on the about 4,000 BTC withdrawal covered the pause.