Reports indicate that the attackers behind last week's Bitcoin bridge exploit have returned the bulk of the stolen coins, with the headline figure putting the reversal at 85% of the original
Reports indicate that the attackers behind last week's Bitcoin bridge exploit have returned the bulk of the stolen coins, with the headline figure putting the reversal at 85% of the original haul. The remaining balance, and whether affected users have been made whole, remains unconfirmed.
WHAT TO KNOW
The central claim is that a large majority of the coins moved back toward the compromised bridge. That reversal figure has not been matched to a specific transaction record, a named bridge, or an absolute quantity of Bitcoin in the material available for this report. For related coverage, see Citi Disclosed Buying Bitcoin: What It Means for BTC.
Because no denominator has been verified, the return should be read as a proportion of the reported loss rather than a confirmed satoshi amount. It is not yet clear whether the funds are native Bitcoin, a wrapped representation, or a dollar-denominated estimate.
Movements of this kind are ultimately settled on the base layer, where each transfer carries a verifiable transaction hash, timestamp, and sender and receiver address. Any return can therefore be independently confirmed on a block explorer such as Mempool.space once the relevant addresses are identified.
Critically, coins arriving at a bridge-controlled address are not the same as reimbursements reaching individual users. Custody by the bridge operator is a necessary step toward recovery, not proof that depositors have been repaid.
The available information describes an attack on a Bitcoin bridge that occurred last week, followed by the partial return. It does not fix the bridge's name, the exact date of the exploit, the size of the original loss, or the mechanism the attackers used.
This incident echoes recent bridge-related thefts covered on this site, including the case in which Liquid halted after hackers took 4,000 BTC and the on-chain standoff where stolen BTC came with demands posted on chain. Whether the current event is connected to those has not been established here.
Operators have at times responded by hardening infrastructure and communicating directly with attackers, as when Blockstream said its bridge nodes were patched in a message to the hacker. No such response has been confirmed for last week's incident.
An 85% return implies a 15% arithmetic remainder, assuming the percentage is accurate and measured against the full amount taken. That remainder is an implied balance, not a verified permanent loss or a confirmed attacker-held sum.
There is no information on whether further returns are expected, whether a reimbursement plan exists, or whether the bridge has resumed normal operation. The retained portion should not be described as a bounty, settlement, or fee without evidence, and prior exploits show recoveries can shift after initial reports, including cases where a bug behind a nine-figure Bitcoin theft surfaced only later.
Until the bridge, the addresses, and the transaction hashes are confirmed, the recovery remains a reported figure rather than a settled outcome. On Bitcoin, that verification is available to anyone willing to trace the coins on chain, which is where this story will ultimately be resolved.
Additional source references: source document 1.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Bitcoininfonews first published the article titled Hackers Return 85% of Bitcoin Stolen in Bridge Attack.
