Liquid hackers returned $270 million in Bitcoin days after draining roughly $320 million from the Liquid Network, a dramatic partial reversal that has left roughly $50 million unaccounted for
Liquid hackers returned $270 million in Bitcoin days after draining roughly $320 million from the Liquid Network, a dramatic partial reversal that has left roughly $50 million unaccounted for and the crypto industry arguing over whether the attackers deserve to be called white hats at all.
The Liquid Network, a Bitcoin sidechain built by Blockstream, publicly acknowledged the security incident on September 6, 2026. The official statement said approximately 4,000 BTC had been withdrawn from the Liquid Federation wallet. For related coverage, see Bitcoin Pumps as Fed Signals Rate Pause, $415 Million in Shorts Get Rekt.
That is not a small crypto exchange. Liquid is a federated sidechain that lets users move Bitcoin into an L-BTC token for faster, confidential transfers, and the compromised wallet sat at the heart of that system. For related coverage, see ProCap Financial Sells 50 Bitcoin to Buy Back Shares at 40% Discount.
Liquid’s own numbers were deliberately hedged. The federation put the loss at approximately 4,000 BTC, valued at approximately $320 million in its statement, and stressed both figures were estimates.
Approximate withdrawal from the Liquid Federation wallet
~4,000 BTC
Liquid Network’s September 6, 2026 incident statement put the withdrawal at approximately 4,000 BTC, valued at approximately $320 million. Both figures are approximate; this is the initial withdrawal, not the reported recovery. Source: Liquid Network.The mechanics were unusually clean. A customer submitted 4,000 L-BTC at 14:05 UTC on Sunday, and the federation paid out 3,996 BTC just 23 minutes later, according to Decrypt’s account of a statement from SideSwap. That is why the event first surfaced as a nearly 4,000 BTC peg-out rather than an obvious breach.
Liquid’s response was swift. The federation disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals, with no date given for resuming normal service, per Decrypt. The scramble to lock things down mirrored the fallout when 3,996 BTC moved after an L-BTC burn.
Then came the twist. The attackers sent 3,400 BTC back to the Liquid federation wallet on Monday, September 7, worth around $269.2 million at the time, Decrypt reported.
Note the split between token count and dollar tag. The headline’s rounded $270 million is a valuation; the concrete number is 3,400 BTC, and Bitcoin’s price at the exact moment of transfer will move that dollar figure.
Roughly 598.5 BTC, worth about $47 million at Decrypt’s valuation, stayed inside the incident-linked address after the return, according to the same report. Whether those coins reach the federation, or whoever Liquid says they belong to, is unconfirmed.
One caution matters here. Decrypt described the actors as self-styled white-hat hackers, an unconfirmed characterization; their intent and authorization are not established, and unsolicited dust or messages sent to a wallet do not prove who controls it.
Do the arithmetic and a gap appears. Subtract the $270 million return from the $320 million withdrawal and you get roughly $50 million, equal to a return of about 84.4% of the reported theft, assuming the two dollar valuations are comparable.
That assumption is doing heavy lifting. The withdrawal was valued on September 6 and the return on September 7, so the percentage is a rough guide, not a verified unrecovered balance or a confirmed user loss.
Blockchain data adds a further wrinkle. Mempool’s confirmed-address records show transaction fcd06c1b with an output of 598.49957160 BTC back to the incident-linked address, confirmed in block 965962 at 18:35:17 UTC on September 7. That is a single output, not a full wallet balance, and it is not the 3,400 BTC refund.
The remaining coins are where the drama concentrated. Ledger CTO Charles Guillemet publicly challenged the white-hat label on September 7, and his reaction crystallized the industry’s unease.
So, 3,400 BTC were refunded. The “white hats” still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking! Let's see what happens to these 600 BTC… https://t.co/nb1p9COmBkpic.twitter.com/BBKLrMVsqd
— Charles Guillemet (@P3b7_) September 7, 2026
Source: @P3b7_ on X
His extortion comparison is opinion, not a legal finding. No regulator or law-enforcement action has been established, and the claim that the retained coins represent an agreed bounty was framed by Guillemet only as a hypothetical.
The backdrop stayed calm. Bitcoin traded at $79,224, down about 0.78% on the day, with a market cap near $1.59 trillion, while the broader Fear & Greed Index read 71, or Greed. The theft dwarfed few recent cases, echoing the scale of the $245 million Bitcoin theft tied to Malone Lam.
So the ledger shows 3,400 BTC home, roughly 600 BTC still in the attackers’ grip, and a signed Blockstream message claiming the bridge nodes were patched that no one has independently verified. Do coins returned under pressure make someone a white hat, or just a thief with second thoughts?
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The article Liquid Hackers Return $270M in Bitcoin After $320M Theft first featured on theccpress.com.
