The incident involving the attack on Blockstream's Liquid sidechain has taken an unexpected turn. On Monday, the attackers returned 3,400 bitcoins out of the approximately 3,998 BTC stolen during the hack. Thus, about 85% of the stolen funds have been returned, but approximately 598 BTC still remain on the hackers' addresses.
Let me remind you that Liquid is a federated bitcoin sidechain developed by Blockstream. Its key feature is the ability to lock BTC on the main network and receive an equivalent amount of L-BTC tokens, which enable faster and more private transactions. The bridge between networks is a critical element of the entire structure, and it was precisely this that became the target of the attack.
Conditions met: the bridge is working again
The return of funds occurred after the hackers achieved their demands. The attackers insisted on closing the vulnerability and updating all bridge nodes. Notably, in a standard scenario, withdrawing bitcoins through the bridge requires signatures from 11 of the 15 participating companies in the Liquid network. However, in this case, the funds went to a completely new address bypassing this procedure—which in itself indicates the severity of the exploited flaw.
In response, Blockstream sent a bitcoin transaction with a signed message confirming that the "hole has been patched" and the funds could be returned. A few hours later, the bitcoins indeed began flowing back. The transfer was included in block 965,950 at 10:09 PM Moscow time.
Silence and the remaining 600 BTC
The fact that approximately 598.5 BTC (about $47 million at an exchange rate of $79,100) still remain on the hackers' address raises questions. Neither side has publicly explained why part of the funds was not returned. This silence even alarmed Charles Guillemet, CTO of Ledger—he had already doubted the "ethical hackers" label that some had attached to the attackers as early as Sunday.
Meanwhile, Blockstream has disabled the bridge and asked exchanges to freeze the deposit and withdrawal of L-BTC. When the service will be fully restored and how the company plans to compensate for the shortfall—these remain open questions.
My analysis: The return of 85% of the funds is a rare and positive outcome for the industry, but it should not be a cause for complacency. The very fact of bypassing the multisignature mechanism is an alarming signal for all federated sidechains. Investors should closely monitor Blockstream's next steps: transparency regarding the remaining 598 BTC will serve as an indicator of the team's maturity and the reliability of the entire Liquid ecosystem.