Liquid gets 3,400 BTC back after federation-wallet drain, but ~598 BTC still missing
Blockstream says patched software is deployed and federation members are preparing a coordinated restart while Liquid remains paused.
Exactly 3,400 BTC (about $270 million) has been sent back to Liquid’s federation wallet after a roughly 4,000 BTC (about $320 million) withdrawal that forced the network to pause. About 598 BTC remains outstanding as Blockstream deploys patches and coordinates a restart, keeping L-BTC backing and peg-in risk in focus.
3,400 BTC Returned, Liquid Still Paused With ~598 BTC Outstanding
Onchain records show exactly 3,400 BTC was transferred back to the Liquid Federation wallet after a weekend incident that drained roughly 4,000 BTC from the wallet. The initial withdrawal came from a balance of roughly 4,200 BTC, leaving Liquid’s reserve position sharply impaired until funds began returning.
JAN3 CEO Samson Mow said about 598 BTC remained outstanding after the return, and that Blockstream continued engaging with the actors. Liquid remained paused at the time described, with the restart framed as a coordinated action across federation members rather than a unilateral switch-flip.
For traders, the partial repayment matters because Liquid issues L-BTC against bitcoin held by the federation. Pulling BTC out of the federation wallet reduces the backing supporting L-BTC until reserves are restored, and the pause adds a second layer of operational risk around when normal peg flows can resume.
How the Incident Touched Peg-Out Infrastructure and Elements
The original withdrawal was processed through SideSwap’s Peg-out Authorization Key, a detail that puts the peg-out authorization path at the center of the incident narrative even as Liquid and SideSwap both said the key itself was not compromised. That distinction matters: it frames the event as an exploitation of surrounding infrastructure or software behavior, not a straightforward key theft.
SideSwap said the L-BTC involved originated from a bug in Elements, the open-source software that underpins Liquid. Beyond that attribution, the technical root cause has not been publicly detailed in the material available, leaving a gap between what is confirmed onchain (the withdrawal and the exact 3,400 BTC return) and what is asserted about how the exploit was achieved.
Blockstream said it contacted the actors through signed messages embedded in Bitcoin transactions. The actors identified themselves as white hats and said they would return most of the funds once the vulnerability was fixed and every node had installed the patch, tying recovery to operational remediation rather than an immediate unwind.
Restart Preconditions: Patched Nodes, Coordinated Federation Action, and Peg-In Warnings
Blockstream said updated software had been deployed and that federation members were preparing for a coordinated restart. Mow said the network remained paused while Blockstream and federation members made further fixes and security improvements, resolved a chain split, and prepared for a safe restart.
User guidance has been explicit and asymmetric. Mow warned users “not to send Bitcoin to Liquid peg-in addresses until the network’s restart is confirmed,” and added that “no user action was otherwise required.” In practice, that makes avoiding new bridge exposure the primary risk control until there is confirmation the pause has ended.
The next concrete signals are procedural and onchain rather than rhetorical: confirmation that Liquid is no longer paused, any movement indicating the remaining ~598 BTC has been returned to the federation wallet (or moved elsewhere), and further disclosures from Blockstream, Liquid, or SideSwap on the Elements bug and whether additional nodes or components required patching beyond the “affected bridge nodes.” Clarity on whether the outstanding BTC is treated as a bounty or reward, and whether any repayment terms exist, is still missing.
What the Partial Return Does—and Doesn’t—Resolve for L-BTC Backing Risk
The repayment is being read as a near-reset, and mechanically it does relieve the immediate reserve stress versus the post-drain state because exactly 3,400 BTC is back in the federation wallet. The threshold that matters now is not the headline percentage recovered, it is whether the remaining ~598 BTC returns and the network restarts cleanly, because backing risk and operational risk are still coupled while Liquid is paused.
The real test is whether the coordinated restart happens after patched nodes are broadly installed, since the actors explicitly conditioned further returns on that rollout. If the pause lifts without further surprises and the outstanding balance is resolved with disclosed terms, the setup starts to look like a contained exploit-and-remediation cycle rather than an ongoing peg credibility overhang.
