Liquid Network has recovered most of the bitcoin taken in Sunday’s exploit, with 3,400 BTC returned by the group behind the attack. Around 598 BTC, worth approximately $47 million, remains outstanding.

The unidentified actors have described themselves as whitehat hackers and appear to have honored their commitment to return the majority of the funds after Liquid addressed the security flaw that allowed the withdrawal.

Samson Mow said the returned bitcoin had been sent back to Liquid’s federation wallet, while Blockstream continues discussions with the group over the remaining balance.

The incident involved the withdrawal of 4,000 BTC, valued at roughly $320 million, from the federation wallet that secures Liquid’s L-BTC token. Developed by Blockstream, Liquid operates as a Bitcoin sidechain designed to provide faster and more private settlement.

A federation of cryptocurrency companies, including exchanges and mining firms, helps operate the network. Its model relies on each L-BTC being backed by an equal amount of bitcoin held in the federation wallet.

The attack removed almost the entire reserve, which had held about 4,200 BTC. Only around 197 BTC remained afterward, leaving Liquid with a substantial gap in the reserves backing its L-BTC supply.

Liquid responded by shutting down its bridge nodes and pausing network operations. Exchanges were asked to stop processing L-BTC deposits and withdrawals while the incident was investigated. Other tokens operating on the network, including Tether, were not impacted.

Mow, a Bitcoin advocate and former Blockstream chief strategy officer, said the dialogue with the hackers was continuing. He said the network would stay offline while Blockstream and federation members implemented further security measures, resolved a chain split and prepared for a secure restart.

The negotiations played out through messages included in Bitcoin transactions. After Blockstream confirmed that the affected bridge nodes had been patched, the group returned 3,400 BTC to the federation wallet but kept the remaining coins.

The recovery has substantially reduced Liquid’s immediate reserve shortfall, but several steps remain before the network can reopen.

Liquid must complete its security work, reconcile the chain split that emerged during the shutdown and establish that the L-BTC system has sufficient bitcoin backing before operations can safely resume.

Mow has advised users to wait for an official announcement and not transfer bitcoin to Liquid peg-in addresses until the network’s restart has been confirmed.