The actors behind the Liquid Network security incident have returned 3,400 BTC to the Liquid Federation wallet while retaining roughly 600 BTC, according to September 7, 2026 reporting, leavi
The actors behind the Liquid Network security incident have returned 3,400 BTC to the Liquid Federation wallet while retaining roughly 600 BTC, according to September 7, 2026 reporting, leaving the sidechain paused and its reserves unreconciled even as Bitcoin trades near $79,300 amid a broader risk-on tape.
The partial return, first surfaced by Decrypt and Bitcoin.com News, follows Liquid Network's September 6 acknowledgment that purported "white-hat" actors withdrew approximately 4,000 BTC, valued at roughly $320 million, from the Liquid Federation wallet, per the protocol's own incident announcement. This is a sidechain incident tied to Blockstream's Liquid Network, not the 2021 breach of the separately owned Liquid exchange. For related coverage, see Liquid Hackers Return 3,400 BTC, Retain About 598.5 BTC.
What is confirmed is narrow: two independent outlets report the same 3,400 BTC return and a residual balance near 600 BTC, while the on-chain leg cited by that reporting could not be independently validated. What remains conditional is nearly everything downstream, from the transaction's confirmation status to whether the retained coins reflect an agreed reward. For related coverage, see PolyNext Awards & Conference Dubai 2026: Advancing the Global Dialogue on Plastic Recycling and Circularity.
Decrypt and Bitcoin.com News both reported on September 7 that the actors sent 3,400 BTC back to the Liquid Federation wallet, a return corroborated across the two outlets even though independent blockchain confirmation was unavailable, according to Decrypt's incident summary. For related coverage, see AINext Awards & Conference Dubai 2026: Where AI Leaders, Innovators and Decision-Makers Shape the Future of Artificial Intelligence.
Liquid Network: BTC reportedly returned3,400 BTC
Decrypt and Bitcoin.com News reported on September 7, 2026 that 3,400 BTC were returned to the Liquid Federation wallet. Transaction outputs and confirmation status were not independently verified.The reporting is the supplied basis for the figure, not an independent on-chain readout: the Bitcoin transaction linked to the return resolved only to a JavaScript application shell when fetched, leaving its outputs and confirmation count unverified. Treat the return as corroborated reporting, not as a settled, final transfer.
The dynamic mirrors prior "return" episodes such as when the Moola Market attacker sent back 93% of the exploited crypto, where a headline recovery percentage preceded any full reconciliation of losses.
The residual balance is where the two outlets diverge in precision: Bitcoin.com News reported the actors retained 598.49955894 BTC, while Decrypt described the remainder as approximately 598.5 BTC, or about 600 BTC in round terms.
Liquid Network: BTC reportedly retained≈598.5 BTC
Decrypt reported approximately 598.5 BTC retained, or about 600 BTC. Bitcoin.com News reported 598.49955894 BTC. These September 7, 2026 figures are attributed reporting, not an independently verified current wallet balance or an established reserve shortfall.The reported 3,400 BTC return set against roughly 600 BTC retained implies a combined figure near 4,000 BTC, an approximate calculation derived from the two reported amounts rather than a verified original loss. That derived total aligns with the protocol's own approximate ~4,000 BTC withdrawal figure, though the components have not been reconciled from transaction data.
On the same derived basis, the return represents roughly 85% of the implied total, leaving about 15% outstanding, percentages that are approximate calculations from the reported figures and not an audited reserve position. The retained amount is not an independently checked current wallet balance and may have shifted after publication.
Blockstream signaled the return was preconditioned on a fix: Decrypt reported the company sent a signed on-chain message stating its bridge nodes had been patched before the 3,400 BTC transfer moved. That sequencing frames the return as remediation-gated, yet a patch message does not by itself establish that reserves are whole.
The headline development is an asset return, not a resumption of service. As of the September 7 reports, Liquid remained paused, bridge nodes were disabled, and normal L-BTC deposit and withdrawal operations had not resumed, according to Bitcoin.com News. A returned tranche of coins does not, on its own, establish that L-BTC backing has been restored or that holders have been made whole.
Nor is the retained balance established as an agreed bounty. Liquid said federation keys were not compromised and SideSwap said its systems were not breached, with the technical account instead pointing to an Elements range-proof verification cache bug, a root cause that remains attributed reporting pending a fetched postmortem. That distinction matters, echoing the earlier stage when a Liquid actor pledged to return Bitcoin after a fix was applied.
Ledger Chief Technology Officer Charles Guillemet publicly disputed the white-hat framing on September 7, acknowledging the refund while questioning whether retaining 600 BTC could fairly be called white-hat work.
So, 3,400 BTC were refunded. The “white hats” still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking! Let's see what happens to these 600 BTC... https://t.co/nb1p9COmBkpic.twitter.com/BBKLrMVsqd
— Charles Guillemet (@P3b7_) September 7, 2026
Source: @P3b7_ on X
His characterization is opinion questioning the actors' motive, not proof that a negotiated agreement or any criminal finding exists. Decrypt reported the actors had not publicly explained why they retained the remainder, and that Blockstream had not immediately responded to its request for comment.
The missing evidence is specific rather than vague. No independently readable transaction payload or confirmation count was available, and the exact receiver address, transfer timestamp, and transfer-time USD value of the return remain unverified against explorer data.
The open items that would upgrade this from reported to verified include the return's timing, an independently confirmed transaction record, recipient confirmation of the Liquid Federation wallet, and a reconciliation separating the rounded ~4,000 BTC figure, miner fees, service costs, the return output, and the retained coins. None of the fetched reporting supplies that full reconciliation.
The supplied context also provides no plan or deadline for the remaining coins; the absence of a stated timeline in the fetched reports should not be read as evidence that no such records or plans exist. The market backdrop is unremarkable relative to the incident: Bitcoin traded near $79,334, down about 0.58% over 24 hours as of September 7, a move not attributable to this event, while the broad-market Fear & Greed Index read 71, or "Greed," a market-wide gauge that does not measure reaction to the Liquid incident.
3,400 BTC, according to September 7, 2026 reporting from Decrypt and Bitcoin.com News, which corroborate the figure even though the on-chain transfer was not independently verified.
About 600 BTC. Bitcoin.com News reported a precise 598.49955894 BTC retained, while Decrypt described roughly 598.5 BTC.
No. The reporting indicates about 600 BTC remains outstanding, and Liquid stayed paused with bridge nodes disabled as of September 7.
No timeline is provided in the supplied reporting, and the actors had not publicly explained why they retained the remainder.
The next concrete trigger to watch is a fetched Liquid or Blockstream postmortem or an independently confirmed on-chain reconciliation, either of which would move the retained ~598.5 BTC and the Elements cache-bug account from attributed reporting toward verified fact, alongside any signed statement on whether the network's L-BTC backing has been restored before deposits and withdrawals resume.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The post Liquid Attacker Returns 3,400 BTC; About 600 BTC Unreturned was initially published on Coincu.
