By Nitesh
- The Liquid Network recovered 3,400 BTC, roughly $269.2 million, on Monday. About 85% of what left.
- 598.5 BTC, around $47 million, was kept. Nobody agreed to that figure, and no bounty was negotiated in advance.
- The takers demanded the bug be patched before returning funds: “Please fix the bug first. The chain is under risk at latest commit right now.”
- Blockstream has deployed updated software and federation members are preparing a coordinated restart.
The Liquid Network has most of its Bitcoin back. On Monday, 3,400 BTC worth about $269.2 million returned to the federation wallet, recovering roughly 85% of the $320 million that left in a single transaction on 6 September.
Yesterday we wrote that one on-chain fact about the Liquid Network would settle whether “white hat” was an accurate description. That fact has now arrived, and the answer is more awkward than either a clean return or a straight theft.
What the Liquid Network actually got back
The Liquid Network received 3,400 of roughly 3,998 BTC. The remaining 598.5 BTC, about $47 million, was retained.
That retention was not agreed. There was no published bounty programme, no pre-arranged disclosure terms, and no negotiated fee. The takers moved the funds first, opened a conversation second, and set their own compensation third.
A bug bounty is a price offered before the work. What happened here is a price extracted after it, from a position of holding the asset. Those are different things, and only one of them is white-hat behaviour.
The Liquid Network demand that complicates the picture
The negotiation happened in public, written into Bitcoin transactions. The operative message from the takers:
Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.
That is, genuinely, responsible. Returning funds to a chain still running the vulnerable code would have exposed them to being taken again by anyone who had since found the same flaw. Insisting on a patch before repayment protected Liquid’s users, not the takers.
So the conduct is split. The initial extraction was hostile and the retained 598.5 BTC is unilateral. The sequencing of the return was competent and considerate. Both descriptions are true, which is why “white hat” and “thief” both fit badly.
What Blockstream has and has not said
Liquid Network software has been updated and deployed, affected bridge nodes patched, and federation members are preparing a coordinated restart.
Three questions remain unanswered. Whether the outstanding 598.5 BTC will be pursued or written off. How the resulting gap in L-BTC backing will be covered, given that outstanding L-BTC represents claims on a reserve that is now short by roughly $47 million. And when peg-in and peg-out services resume.
The second question is the one holding real consequences. Anyone holding L-BTC is a creditor of a reserve with a hole in it, which is the distinction covered in our explainer on custodial versus non-custodial storage. Whether Blockstream absorbs the shortfall from its own balance sheet, or holders share it, has not been stated.
TechToken Take
The Liquid Network outcome establishes a price, and that is the part the industry should be uncomfortable about.
On the Liquid Network, 598.5 BTC is now the going rate for finding a mint bug in a federated bridge and holding the collateral while you explain it. Not a rate anyone negotiated, and not one any organisation published. A rate set unilaterally by whoever moved first, and then accepted, because 85% back is enormously better than nothing.
Blockstream had no realistic alternative. Bitcoin will not reorganise for a sidechain, so unlike the Cronos rollback that discarded 10,961 blocks to reverse a $75 million exploit, there was no technical route to recovery. Negotiation was the only instrument available. That asymmetry is precisely what made the retained fee collectible.
For anyone running a bridge, the lesson is not about disclosure policy. It is that a published bounty large enough to be worth claiming is cheaper than an unpublished one set by someone holding your reserves. The mechanism that produced this is the same lock-and-mint design we described in how crypto bridges keep getting hacked, and it has not changed.
What to watch
Whether Blockstream publishes the Elements bug in detail. Other chains are built on the same codebase, and a patch without disclosure leaves everyone else guessing whether they are exposed.
Whether the 598.5 BTC taken from the Liquid Network moves again. If it is laundered rather than held, the white-hat framing collapses entirely, and that is observable on-chain by anyone.
And whether L-BTC trades at par when peg services resume. That price is the market’s verdict on who absorbs the shortfall, and it will be visible within hours of reopening. Cointelegraph and Bitcoin Magazine are both tracking the restart.
What's your reaction?
