- About 3,400 bitcoin has been sent back to the Liquid federation wallet emptied on Sunday. Roughly 598 BTC, near $47m, has not, and public readings of the reserve now imply it covers about 85% of the L-BTC in issue.
- Blockstream has refused a ransom demand for the rest and says it is working with law enforcement, exchanges and forensic specialists. L-BTC is trading again on SideSwap, but peg-outs stay disabled, so there is no route back to real bitcoin.
- Bitcoin’s own security was not the failure point. Earlier reporting says the coins left through a working authorisation key.
Nearly all of the bitcoin taken from Blockstream’s Liquid sidechain on Sunday has been sent back. About 598 of it has not, whoever is holding it has since asked to be paid, and Blockstream has said no. The network is taking transactions again and L-BTC is trading, but nobody can take their bitcoin off it yet.
If you hold bitcoin through anything with a prefix on it, a sidechain or a wrapped version, you do not hold bitcoin. You hold a claim on coins that other people are looking after, and this week those people lost control of them for a while. Everything else in this story follows from that one distinction.
What Liquid actually is
Liquid is a sidechain. It’s a separate that runs alongside bitcoin, settling transactions faster and more privately than the main chain manages, and it is used mostly by exchanges and trading desks moving size between venues.
Getting on to it means sending bitcoin to what’s called a peg-in address. Those coins are then held collectively by the Liquid federation, a group of companies that jointly control the wallet through a multi-signature arrangement, and you receive L-BTC on the Liquid chain in return. The L-BTC is redeemable for the real thing, in theory one for one, whenever you want to come back the other way.
So the coins backing L-BTC sit in a wallet controlled by a committee. That trust model has almost nothing in common with holding your own keys, which is the distinction our guide to self-custody keeps coming back to, and it’s the reason this incident was possible at all.
What left, and what came back
The exact amount drained on Sunday still isn’t settled in public. CoinDesk describes the federation reserve falling from roughly 4,200 BTC to about 197 BTC. Decrypt puts the drain at around 4,000 BTC. Nobody has published a reconciled figure, and the gap between those two accounts is itself worth a few hundred bitcoin.
What’s agreed is that 3,400 BTC has been sent back and that roughly 598 BTC, around $47m at current prices, has not. We have not independently confirmed through a block explorer that the returned coins have settled into the federation’s operative wallet rather than simply being broadcast, and neither, as far as we can see, has anyone else reporting on it.
Other assets issued on Liquid, tether among them, were not touched. The Blockstream-built network has now resumed transactions, but peg-outs, the mechanism that converts L-BTC back into real bitcoin, remain switched off while the chain split caused by the incident is unpicked. A chain that processes payments but won’t let you leave it is only partly back.
Trading has gone further than redemption. SideSwap, one of the main venues for L-BTC, said on 10 September that Liquid was producing blocks and that all of its markets were open, while its own peg-ins and peg-outs stayed closed pending the federation’s security review. SideSwap runs the trading venue and the wallet; the federation controls the reserve and authorises peg-outs. That division is how a market can reopen days before anyone can actually redeem.
The result is an L-BTC that has a live price and no exit. CryptoSlate read a Blockstream explorer endpoint at 22:55 UTC on 10 September showing 4,229 L-BTC outstanding, against 3,601 BTC in the address cited as the federation reserve. That works out at coverage of about 85%, a shortfall of roughly 627 BTC, which is a bigger hole than the 598 BTC figure everyone has been quoting. Both are point-in-time readings from public endpoints rather than an audited reconciliation, and the federation has not published one.
The Defiant and CoinDesk both describe the recovery as having been negotiated by writing messages into bitcoin transactions themselves, attacker and federation talking to each other through the chain. It’s a good detail and it may well be right. It is also a narrative assembled by secondary reporting rather than something anyone has published the raw transactions to demonstrate.
Who is actually speaking for Blockstream
For three days the company said nothing publicly under its own name after Sunday evening’s initial statement. The updates people were reading, including the return figures, came from Samson Mow, Blockstream’s former chief strategy officer, posting on his personal X account.
“Approximately 598 BTC remains outstanding, and Blockstream continues to engage with the white-hat hackers,” Mow wrote. On the network itself: “The network remains paused while Blockstream and Federation members make additional fixes and security improvements, resolve the chain split, and prepare for a safe restart.” He also asked users to sit still: “No user action is needed, and please do not send Bitcoin to Liquid peg-in addresses until we confirm the network has restarted.”
Those posts were treated across the coverage as though they carried corporate authority, and we could not find any Blockstream blog post, press release or official-account statement confirming that they did. That has changed. The company has now answered the attacker directly and in its own name, refusing to pay for the outstanding coins and saying it will work with law enforcement, exchanges and forensic specialists to recover them. It took a ransom demand to produce the first thing Blockstream has put on the record since Sunday, and there is still no post-mortem explaining how the wallet was drained in the first place.
The white-hat label is doing a lot of work
The attackers identified themselves on-chain as white hats, the term for someone who breaks in to prove it can be done and then hands the money back. In the cases the industry usually cites, Poly Network in 2021 and Euler Finance in 2023, the funds came back in full or very close to it.
Here the balance was never settled, and the negotiation has now turned into something else. According to The Block, whoever holds the remaining coins has demanded a payment to return them, and Blockstream’s public answer was to tell them to return the bitcoin. A partial return followed by a price tag on the rest is not a white-hat rescue, whatever the first on-chain messages said, and the $47m still outstanding is now the subject of a law enforcement matter rather than a handover.
Earlier reporting from The Defiant added the detail that matters most for anyone assessing the risk: the coins reportedly left through a working authorisation key rather than a stolen or broken one. If that holds up, nothing about bitcoin’s cryptography failed. The failure was in who was allowed to sign, and how that was controlled.
What to watch
Whether the remaining coins move at all now that talks have broken down, and where they go if they do. Whether peg-outs are switched back on, because the one-for-one claim stays untested until they are, and on the public numbers it is currently short. And whether Blockstream follows its refusal with a post-mortem and a full accounting of L-BTC backing, including a reconciliation that settles whether the gap is 598 BTC or closer to 627.
For UK readers, the practical version is smaller. Look at what you actually hold on your exchange or in your app. If the ticker has a letter in front of it, L-BTC, WBTC, cbBTC, somebody else is holding the bitcoin and their arrangements are your risk. A token can carry on trading at a price of its own while the reserve behind it is 15% light, and the price is not the same thing as the redemption.