Liquid Network said Tuesday that Blockstream is still in discussions with the people responsible for the exploit that drained roughly $320 million from the Bitcoin sidechain, as the project tries to recover the funds that remain outstanding.
In an incident report posted on X, Liquid said: 「Discussions between Blockstream and the individuals responsible are ongoing to secure the return of the remaining funds.」
About 600 BTC remains unrecovered
The talks follow a Sunday withdrawal of about 4,000 BTC after a flaw in the underlying Elements software allowed the creation of unbacked L-BTC, which was then exchanged for reserve Bitcoin.
Liquid said 3,400 BTC was returned on Monday. That leaves about 600 BTC still missing, valued in the report at roughly $47 million.
The network did not disclose the terms of the discussions or give a timeline for recovering the remaining BTC.
How the withdrawal was processed
According to Liquid, the unidentified individuals exchanged the BTC through SideSwap, a Liquid Federation member that operates a withdrawal service.
The project said transaction checks in the software accepted the unbacked tokens as valid before the withdrawal process began.
Developers wrote: 「Because the validation failure occurred at the transaction level before the peg-out was initiated, both SideSwap’s node and the Liquid Network’s globally distributed functionary nodes accepted the LBTC as valid.」
Reserve balance dropped sharply after the exploit
Liquid said its reserve fell from about 4,205 BTC to 197 BTC after that withdrawal and other withdrawals processed before operations were halted.
It added that USDT and other Liquid-issued tokens were unaffected by the vulnerability, although users were unable to transact while the network was paused.
Liquid also said: 「The Liquid Federation functionaries were not hacked, and no private keys were compromised.」 The project added that the peg-out mechanism authorizing withdrawals to whitelisted addresses operated as designed.
White-hat claim faces criticism
At the time of the exploit, the individuals involved identified themselves in a message on the Bitcoin blockchain as white-hat security researchers. That description has not gone unchallenged, even after most of the funds were returned.
Ledger Chief Technology Officer Charles Guillemet wrote on X: 「The ‘white hats’ still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!」
Emergency update is being prepared
Liquid Network developers said Blockstream is preparing an emergency update while the fix is under review, after a patch was applied to bridge nodes on Monday.
Once that update is finalized, network operators will make more changes to restore operations and correct the network state, including rejecting the invalid withdrawal.
Liquid said: 「Our immediate priorities are recovering the remaining funds and resuming normal network operations safely and as quickly as possible.」