Liquid Network has recovered 3,400 BTC after an unusual withdrawal involving nearly 4,000 BTC, but roughly 598.5 BTC remains tied to the incident. The network has also kept its L-BTC peg services offline and has not announced when they will be restored.

The returned Bitcoin is worth about $269.2 million, meaning roughly 85% of the funds involved have been recovered. The group responsible for the withdrawal later claimed to be white-hat hackers and sent the coins back to Liquid’s federation wallet.

Another 598.5 BTC, worth approximately $47 million, remains at an address associated with the incident. Liquid has yet to confirm whether those funds are expected to be returned or explain how it would handle a possible shortfall in the Bitcoin backing L-BTC.

The recovery therefore does not mark the end of the incident. Liquid still faces unanswered questions surrounding the remaining Bitcoin, reserve coverage and the reopening of its peg infrastructure.

What Happened During the Liquid Bitcoin Incident?

The incident began Sunday after a customer transferred 4,000 L-BTC to SideSwap’s peg-out service. The transaction resulted in an unexpected movement of Bitcoin from Liquid’s federation reserves.

Liquid reacted by taking its bridge nodes offline and requesting that exchanges temporarily stop L-BTC deposits and withdrawals. The suspension was intended to contain the situation while the network investigated the withdrawal and secured its infrastructure.

The parties behind the transaction later identified themselves as white hats in a message recorded on the Bitcoin blockchain. They said the network could remain exposed until the relevant nodes were fully patched.

Blockstream, the developer of Liquid, subsequently communicated with the group through Bitcoin transactions. The exchanges eventually led to a signed message from Blockstream stating that the bridge nodes had been patched and were safe to operate.

The group then transferred 3,400 BTC back to Liquid’s Federation address. Earlier, they had indicated that they would return most of the funds but did not explain why the remaining Bitcoin would stay in their possession.

The episode has once again drawn attention to the risks surrounding Bitcoin sidechains. Liquid depends on a federation wallet and bridge-node infrastructure, both of which were taken offline after the abnormal transaction was detected.

L-BTC transfers remain suspended, leaving users unable to use the network’s peg to move assets in and out of the sidechain. Liquid has not provided a date for the resumption of these services.

Ledger Chief Technology Officer Charles Guillemet has questioned whether the attackers should be considered genuine white hats. He argued that keeping roughly 600 BTC after returning most of the funds looks less like a standard bug-bounty arrangement and more like extortion.

The dispute highlights a broader concern in crypto: whether attackers who return a portion of stolen or improperly withdrawn assets should still be viewed as white hats.

Liquid has yet to clarify the fate of the remaining 598.5 BTC, how it would cover any potential gap in L-BTC backing, or when normal sidechain and peg operations will resume.