Liquid recovered 3,400 BTC from a reserve drain, while the self-described whitehats behind the incident kept about 598.5 BTC, valued at roughly $47 million on the transaction record, before the terms of that arrangement were made clear. For Southeast Asian traders who route Bitcoin through Liquid-linked services, the episode is a reminder that a partial recovery is not the same as a fully restored, redeemable reserve.
TLDR KEYPOINTS
- Liquid reportedly recovered 3,400 BTC from the reserve drain.
- Self-described whitehats reportedly kept about 598.5 BTC.
- The record values the retained BTC at about $47 million, without a stated valuation date.
Liquid Recovers 3,400 BTC From the Reserve Drain
A single Bitcoin transaction confirmed on September 7, 2026 at 16:09:25 UTC moved 3,400 BTC from an address labeled “Liquid Hack” to one labeled “Liquid.” Those labels are provider attributions, not independently proven legal identities. For related coverage, see Bedrock (BR): A New Chapter for Bitcoin Capital and Liquid Staking.
BTC recovered by Liquid
3,400 BTC
What the Reported Recovery Covers
The 3,400 BTC figure is the amount returned in this transaction, not a confirmed full recovery. The Liquid Network publicly acknowledged that purported white-hat actors withdrew roughly 4,000 BTC, about $320 million, from the federation wallet, its own approximate figures. The transaction and the acknowledged outflow are distinct quantities, and the original reserve balance is not established here. For related coverage, see PolyNext Awards & Conference Dubai 2026: Advancing the Global Dialogue on Plastic Recycling and Circularity.
The mechanism reported by the operator points to authorization keys rather than a broken cipher. Blockstream’s incident statement says withdrawals used the SideSwap peg-out authorization key, while asserting that this key and other keys were not compromised, an operator assessment rather than a completed forensic finding. Regional readers following the earlier commentary on who drained the Liquid Federation should treat this as a working account, not a verdict. For related coverage, see AINext Awards & Conference Dubai 2026: Where AI Leaders, Innovators and Decision-Makers Shape the Future of Artificial Intelligence.
Self-Described Whitehats Keep About 598.5 BTC
The same transaction page displays a 598.49 BTC output routed back to the sender address, the retained amount referenced in the headline. The word “about” matters: the display is rounded, not satoshi-level precision.
BTC output returned to the sender
598.49 BTC
The Reported $47 Million Valuation
The transaction record values that retained output at $47,204,766, a provider-displayed transaction valuation rather than a current market quote. The actors remain self-described whitehats; their status and authorization are unverified, and the retained funds should not be characterized as an agreed bounty, settlement, or fee absent evidence.
According to unconfirmed reports summarized by CryptoSlate, the sender attached an on-chain message paraphrased as asking whether returning most of the funds was acceptable. That underlying message transaction was not independently fetched, so it is paraphrased with attribution, not authenticated.
SideSwap, the peg-out service named in the incident, issued its own account of the flow.
Statement on today's Liquid incident
Today at 14:05 UTC a customer sent 4,000 L-BTC to the SideSwap peg-out service. Our service processed it like any other order: the L-BTC was burned on Liquid with a valid peg-out authorisation, and at 14:28 UTC the Liquid Federation paid…
— SideSwap (@side_swap) September 6, 2026
Source: @side_swap on X
SideSwap describes the receipt and processing as a routine peg-out with valid authorization, framing itself as a conduit rather than the point of failure. The statement is from the involved service, not an independent security auditor.
What Remains Unverified About the Liquid Reserve Drain
Key facts are still open. Blockstream at research time listed an active Liquid security incident and a major outage for public bridge nodes, saying bridge nodes were disabled and that exchanges had paused or would pause L-BTC deposits and withdrawals. Claims that all legitimate L-BTC is fully backed and that redemptions have reopened are not confirmed; the live dashboard still reported a major outage.
Recovery Terms and Remaining Exposure
The reported figures do not reconcile into a clean whole. CryptoSlate’s September 8 report describes roughly 3,996 BTC in the original federation outflow and roughly 3,998.5 BTC spent by the later recovery transaction, distinct quantities that should not be collapsed into one starting balance. Return and retention terms, the total amount drained, and any unrecovered remainder are not established.
Broader market conditions were steady rather than panicked. Bitcoin traded at 78,871.84 USD on the transaction page display, and the broad crypto Fear and Greed reading sat at 69, in Greed territory, a market-wide gauge that cannot be attributed to this incident.
For Southeast Asian venues such as Indodax, Tokocrypto, and Coins.ph, the operational takeaway is redemption access, not headline recovery. As long as bridge nodes stay down and L-BTC transfers are paused, regional users tracking the week’s Liquid Network developments should watch for a confirmed service restart and a reserve reconciliation before treating the sidechain as fully operational. Those details are unverified and should be confirmed against official statements as they are published.
Additional source references: source document 1.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
