Bitcoin sidechain Liquid Network experienced a security breach on September 6, resulting in the theft of approximately 4,000 bitcoin from its federated wallet. As of September 7, the attacker has returned 3,400 bitcoin, while discussions to recover the remaining 598 bitcoin, valued at roughly $47 million, are still underway.

Developed by Blockstream, Liquid Network operates as a settlement layer built on top of the Bitcoin blockchain, designed to offer enhanced transaction speed and privacy. The network is jointly maintained by several prominent cryptocurrency exchanges and mining firms, and its native L-BTC tokens are theoretically pegged 1:1 to bitcoin locked in the federated wallet.

This attack nearly drained the federated wallet's reserves of approximately 4,200 bitcoin, leaving only 197 coins and causing a significant shortfall in L-BTC collateral. In response, network operators immediately disabled bridge nodes, suspended network operations, and requested exchanges to halt L-BTC deposits and withdrawals. Other assets issued on the Liquid network, including Tether stablecoins, were unaffected by the incident.

According to Samson Mow, former Chief Strategy Officer at Blockstream, the company is maintaining communication with the attacker. During the network suspension, Blockstream and federated wallet members have been implementing additional security fixes and system optimizations to resolve network forks and prepare for a safe restart.

The attacker reportedly initiated public negotiations through bitcoin transaction messages. After Blockstream completed patches for the relevant bridge nodes, the attacker returned 3,400 bitcoin. This return has alleviated the immediate collateral crisis for L-BTC, but the Liquid Network still needs to finalize security hardening, address network forks that occurred during the pause, and restore market confidence in full collateralization of L-BTC.

Mow emphasized that users need not take any action, but cautioned against sending bitcoin to Liquid Network deposit addresses until the network confirms its restart.