Key points

  • Bitcoin transaction data confirms a 3,400 BTC output in block 965,950 on September 7.
  • The transfer returned about 85% of the roughly 4,000 BTC withdrawn during the September 6 incident.
  • Recovery of the coins and restoration of Liquid's services are separate steps; a completed restart was not verified.

Liquid Network recovered 3,400 bitcoin on September 7, returning most of the funds withdrawn from its federation wallet a day earlier. Bitcoin transaction data reviewed by The Token Press confirms the transfer, while reporting from The Block and Cointelegraph identifies the destination as the federation's wallet.

The repayment represents about 85% of the roughly 4,000 BTC involved in the incident. It is a substantial recovery, but it does not by itself establish that Liquid's services have restarted or that every outstanding issue has been resolved.

Earlier coverage: Hyperscale Data Ends Bitcoin Mining as BTC Holdings Fall 79%

What the transaction confirms

The transaction recorded in Bitcoin block 965,950 contains an output of exactly 3,400 BTC and a separate output of 598.49955894 BTC returning to the withdrawal-linked address. Its recorded block timestamp is September 7 at 16:09:25 UTC, according to the public Mempool transaction data. The underlying record establishes the movement and amount independently of the descriptions used in subsequent news coverage.

Those figures describe the outputs at the time of the return, not a guarantee of the address's current balance. The Block reported approximately 598.5 BTC remaining after the repayment; the transaction record alone does not reveal any private agreement governing those coins.

The withdrawal and the repair response

The incident began on September 6, when roughly 4,000 BTC was withdrawn through Liquid's authorized peg-out process, according to The Block. In reporting SideSwap's account, the outlet said the service received 4,000 L-BTC, processed a valid authorization and the federation paid 3,996 BTC to the customer's Bitcoin address.

SideSwap attributed the affected L-BTC to an Elements software bug and said its systems and authorization key had not been compromised, The Block reported. This account describes a software-related failure rather than a disclosed theft of that key; a complete technical investigation should not be inferred from the initial explanation.

Why repayment is not the same as reopening

Liquid uses L-BTC to represent bitcoin held by its federation, a structure intended to allow settlement on the sidechain. CoinDesk's coverage explains that the tokens are designed to have one-for-one bitcoin backing, making recovery of the withdrawn reserves important to the system's operation.

Cointelegraph reported on September 8 that updated software had been deployed and federation members were preparing a coordinated restart. It also attributed continuing security work and efforts to resolve a chain split to an update from Samson Mow, JAN3's chief executive and a former Blockstream executive.

That is an account of preparations, not confirmation that normal service has resumed. This report has not independently verified a completed restart, and readers should distinguish a confirmed movement of bitcoin from the separate operational decision to reopen the network.

What remains unconfirmed

Decrypt reported that the return followed an on-chain message from Blockstream saying its bridge nodes had been patched. The actors described themselves as white-hat hackers, but that self-description does not establish authorization for the original withdrawal or an agreed entitlement to retain funds.

Cointelegraph said neither Blockstream nor Liquid had publicly characterized the outstanding bitcoin as a bounty or disclosed repayment terms before its report was published. The verified development is therefore a partial return of reserves, with the remaining funds and the network's restoration still requiring further confirmation.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.