.jpg)
The Liquid Network got most of its money back, and the question is no longer whether the attackers were white hats but what to call a group that keeps $47 million without permission. On-chain records confirm 3,400 BTC returned following the bridge exploit that drained roughly 4,000 BTC, or 95% of the sidechain's backing, leaving about 598.5 BTC, near $47 million, in the attackers' wallets.
The negotiation trail is public. The attackers had posted via OP_RETURN messages: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix." Blockstream disabled bridge nodes, applied patches and asked exchanges to suspend L-BTC deposits and withdrawals. The return followed. A 75% return precedent exists: in May 2026, a Verus bridge attacker gave back 75% of stolen funds while keeping 1,350 ETH, about $2.8 million, under a public settlement offer. That deal was at least disclosed as a deal. Liquid's was not.
"So, 3,400 BTC were refunded. The 'white hats' still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!" — Charles Guillemet (@CharlesGuillemet), Ledger CTO, September 7, 2026
The Solvency Question Nobody Answered
Liquid has not clarified whether remaining L-BTC is now under-collateralized, or how the $47 million shortfall gets covered. That silence is dangerous for a federated sidechain whose entire value proposition is 1:1 backing, the flaw we flagged when the attackers first offered to return the funds. Reopening the peg without covering the deficit risks the obvious: L-BTC holders rushing to redeem before the backing runs out. No technical postmortem has arrived either, so whether the flaw lived in SideSwap, Elements, or bridge software is still unknown, which means other federated deployments cannot rule out the same bug.
The legal exposure is now the story. Keeping $47 million that was never offered, with no bounty program, no contract and no agreement, is not a reward; it is retention of stolen property, and it hands prosecutors a clean narrative regardless of the return. Ledger's CTO calling it extortion in public is the security industry telling every future attacker that this playbook has a ceiling.
Watch two prints: the resumption of bridge operations with published collateral figures, and the postmortem. If the deficit is quietly absorbed by Blockstream or federation members, the model survives. If it is socialized across L-BTC holders, the flagship of a year full of protocol failures loses the one thing a federation cannot trade away: the 1:1 promise.
