Liquid exploit: 3,400 BTC returned, about 600 BTC still unaccounted for

ChainCatcher reports that an attacker claiming to be a \u0022whitehat hacker\u0022 has returned roughly 3,400 BTC (about $269.2 million) to the Liquid Network federation wallet on Monday, after taking around 4,000 BTC—recovering about 85% of the total. The incident began Sunday when a customer sent 4,000 LBTC to SideSwap\u0027s pegout service. In a message embedded in a Bitcoin transaction, the attacker said the vulnerability needed to be patched before any funds would be sent back. Blockstream later issued a signed statement saying, \u0022The bridge node has been patched; funds can be safely returned,\u0022 and the attacker subsequently transferred the BTC. About 598.5 BTC (roughly $47 million) remains at the related address. Ledger CTO Charles Guillemet questioned the \u0022whitehat\u0022 narrative, arguing that if the outcome is a negotiated reward without an onchain smart contract, it looks closer to extortion. Liquid has disabled the bridge node and asked exchanges to pause LBTC deposits and withdrawals. It has not disclosed how it plans to address the remaining funds or when normal operations will resume.