Key Highlights
- Blockstream told the actors controlling nearly 4,000 BTC that Liquid’s bridge nodes had been patched and the funds were safe to return.
- At 12:16 UTC on September 7, the actors again asked Blockstream to confirm the federation return address and included additional PGP-encrypted details about the vulnerability fix.
- Roughly 3,998.5 BTC remained under the actors’ control in the latest on-chain exchange, meaning the proposed return had not yet been completed.
The actors controlling nearly 4,000 Bitcoin (BTC) withdrawn from the Liquid Network have again asked Blockstream to confirm where the coins should be returned, hours after the company said its bridge nodes had been patched.
At 12:16:29 UTC on September 7, an OP_RETURN message confirmed in Bitcoin block 965,927 asked Blockstream to “confirm again” that the coins should be returned to the Liquid Federation address bc1qdlld6…suhwxxr. The message also included another PGP-encrypted block described as providing more details about the vulnerability fix. Mempool records block 965,927 at 12:16:29 UTC.
The request followed Blockstream’s PGP-signed message saying “Bridge nodes are patched, safe to return the funds.” That message was confirmed in Bitcoin block 965,910 at 09:19:46 UTC.
Despite the apparent progress toward a return, the roughly 3,998.5 BTC had not been returned to the federation wallet in the latest exchange. The actors had previously said they intended to send back “most” of the Bitcoin, rather than explicitly committing to return the entire balance.
On-Chain Talks Move From Bug Fix to BTC Return
The public negotiations began at 18:30:10 UTC on September 6, when the actors consolidated the withdrawn Bitcoin and left an OP_RETURN message identifying themselves as “whitehats” and asking Blockstream to contact them on-chain.
Mempool shows the transaction was confirmed in block 965,818 and left 3,998.49748445 BTC at the actor-controlled address after sending 1,000 satoshis to the Liquid Federation wallet.
At 19:31:47 UTC, Blockstream responded through another Bitcoin transaction, telling the actors to contact its security team. The transaction was confirmed in block 965,822, whose timestamp is recorded by Mempool at 19:31:47 UTC.
Blockstream followed at 01:49:49 UTC on September 7 with an encrypted on-chain message confirmed in block 965,865. Mempool records that block at 01:49:49 UTC.
The actors then indicated at 02:20:18 UTC that they were preparing to return the Bitcoin. Their OP_RETURN transaction said they were “sending most back” to bc1qdlld6…suhwxxr and asked whether the address was correct.
The transaction was confirmed in block 965,869 and again sent 1,000 satoshis to the federation address while returning 3,998.49848550 BTC as change to the actor-controlled address.
Actors Asked Blockstream to Patch Every Node First
The proposed return was then put on hold. At 03:30:05 UTC, the actors sent another OP_RETURN transaction telling Blockstream to fix the vulnerability before they transferred the Bitcoin.
The message asked Blockstream to ensure every node was patched and said the funds would be transferred back after the fix was confirmed. It also included vulnerability information encrypted with PGP. The transaction was confirmed in block 965,875, which Mempool timestamps at 03:30:05 UTC.
A separate PGP-signed Blockstream response saying “Yes, thank you” was confirmed in the same block and therefore carries the same 03:30:05 UTC Mempool timestamp.
Blockstream later provided the confirmation the actors had requested. Its “Bridge nodes are patched, safe to return the funds” message appeared in block 965,910 at 09:19:46 UTC. An identical signed message was subsequently recorded again in block 965,912 at 09:41:26 UTC, according to Mempool’s block records.
The actors’ 12:16:29 UTC response then moved the exchange back to the return itself, asking Blockstream to reconfirm the federation address while providing further encrypted information about the fix.
How Nearly 4,000 BTC Left Liquid
The negotiations follow the September 6 security incident that led Liquid to temporarily pause its network.
As The Crypto Times previously reported, roughly 4,000 BTC worth about $320 million was withdrawn from the Liquid Federation wallet.
The main federation transaction was confirmed at 14:28:56 UTC on September 6. The Mempool transaction included a 3,996.01834922 BTC payout, which was subsequently forwarded toward the address later used by the actors.
Liquid said in its official incident disclosure that roughly 4,000 BTC had been withdrawn through SideSwap’s Peg-out Authorization Key, or PAK, but said the PAK itself had not been compromised, nor had other federation keys.
SideSwap’s incident update said a customer sent 4,000 L-BTC to its peg-out service at around 14:05 UTC. The L-BTC was burned using a valid peg-out authorization before the federation released approximately 3,996 BTC.
SideSwap later said Blockstream had traced the affected L-BTC to a bug in Elements, the open-source software underlying Liquid. The company said neither its systems nor its PAK had been compromised.
Liquid Incident Remains Active
Blockstream’s confirmation that the bridge nodes are patched does not mean the broader incident has been resolved.
Blockstream’s official status page still lists the Liquid Security Incident as active, with public bridge nodes identified as the affected component. The company says exchanges were asked to pause L-BTC deposits and withdrawals and that the Liquid sidechain was effectively paused while federation members worked to resolve the incident.
The distinction is important because there are now two separate developments: Blockstream says the relevant bridge nodes have been patched, but the Bitcoin still needs to be returned.
The actors’ latest message indicates that the parties have progressed to reconfirming the destination for the repayment, but it does not itself constitute a recovery. The decisive on-chain event will be a transfer of the approximately 3,998.5 BTC back to the Liquid Federation wallet.
Also Read: Crypto Hacks Cross $322M in September’s First Week as Liquid Network Alone Loses $320M
