Liquid Network Hack developments took a major turn today after roughly $268M worth of Bitcoin was sent back to Blockstream's federation wallet, just days after the original withdrawal.
On-chain records show the attackers returned 3,400 coins while keeping 598.5 of them, worth close to $47M, for themselves—without any formal bounty agreement ever being made public.
Source: Onchain Report on X
A transaction visible on public block explorers confirms the split outcome directly.
Inputs totaling roughly 3,998.5 coins were consolidated and then divided into two separate outputs—one sending 3,400 coins to the federation-controlled address tied to Blockstream's operations and another keeping 598.49955894 units moving back to a wallet already associated with the original withdrawal.
The same transaction also contained a series of small dust amounts commonly used to carry short on-chain text messages between parties.
Key figures from this settlement include:
3,400 coins worth about $268M sent back to the federation wallet
598.5 BTC worth roughly $47M kept by the attackers
No formal bounty agreement publicly confirmed by either side
Blockstream reportedly replied on-chain with a signed message simply reading "yes, thank you"
Blockstream's own account confirmed that its team, along with the Liquid Federation, had been working diligently to resolve the situation and secure the return of assets following the incident.
The company said updated software has now been deployed as federation members prepare the system for a coordinated restart, adding that engineering teams remain focused on further hardening it against similar issues going forward.
Source: Blockstream Official Update on X
Blockstream also thanked the wider Bitcoin community for its patience, support, advice, and assistance throughout the process, while promising continued updates as recovery work progresses.
| Detail | Figure |
| Amount originally withdrawn | Roughly 4,000 BTC, worth about $320M |
| Amount returned to the federation | 3,400 BTC, worth about $268M |
| Amount kept by the attackers | 598.5 BTC, worth roughly $47M |
| Formal bounty agreement | Not publicly confirmed |
| Sidechain status | Bridge nodes remain paused pending restart. |
| Monitoring resources | Liquid Explorer and Blockstream status page |
Source: Additional Coverage on X
Even with most of the funds back in federation hands, the sidechain has not yet resumed normal operation.
The official status page still lists the incident as active, with bridge nodes disabled and no new transactions able to reach the chain until federation members complete a coordinated restart.
Blockstream's own language around hardening the system suggests the pause is being used to strengthen it, rather than simply waiting for a green light to reopen.
This turn of events in the Liquid Network Hack case fits a familiar pattern seen in other large-scale on-chain incidents, where funds move first, negotiations happen entirely through public signed messages rather than private channels, and a partial return eventually follows without either side ever confirming specific terms.
The gap between the $268M sent back and the $47M retained effectively functions as an informal reward, even though nobody has called it that on the record.
This chapter of the Liquid Network Hack story shows a mostly favorable outcome for Blockstream, with the overwhelming majority of withdrawn funds now back under its control, though real questions remain about exactly when the sidechain reopens and whether any further clarification on the informal bounty ever becomes public.
Anyone holding assets on the network should keep watching official channels until a coordinated restart is confirmed and normal activity fully resumes.
This content covers financial markets and is for general information only. It is not financial, investment, trading, or legal advice. Crypto assets are volatile and can lose value fast. Always do your own research. Speak with a licensed financial advisor before making investment decisions.
