The Liquid attacker has returned 3,400 BTC, with approximately 600 BTC yet to be returned.

According to ChainCatcher, an attacker claiming to be a "white hat hacker" extracted approximately 4,000 BTC from the Liquid Network and, on Monday, returned 3,400 BTC (around $269.2 million) to the sidechain's federal wallet, recovering about 85% of the funds. The incident began on Sunday when a customer sent 4,000 L-BTC to SideSwap's peg-out service. The attacker identified themselves as a "white hat hacker" via a Bitcoin transaction message and demanded the vulnerability be fixed first. Blockstream then sent a signed message stating "bridge nodes have been patched and funds can be safely returned," after which the attacker transferred the funds back. Nevertheless, approximately 598.5 BTC (about $47 million) remains at the related address. Ledger's Chief Technology Officer, Charles Guillemet, expressed skepticism about the "white hat" claim, suggesting that if this is a negotiation for an on-chain cryptographic contract reward, it appears more like extortion. Liquid has disabled bridge nodes and requested exchanges to suspend L-BTC deposits and withdrawals, but has not yet announced a plan for handling the remaining funds or when normal operations will resume.