Hackers Return 85% of Stolen Bitcoin from Last Week’s Bridge Attack

Source: bitcoinethereumnews2026/09/08 06:32

Analysis

The partial return of 3,400 BTC by the Liquid bridge attackers marks an unusual resolution pattern in crypto security incidents, where the hackers conditioned the refund on Blockstream first patching the vulnerability across all bridge nodes. The remaining 598.5 BTC, worth roughly $47 million, has not been explained by either party, and Ledger CTO Charles Guillemet has publicly questioned whether this constitutes white-hat behavior or veiled extortion. This incident highlights the growing complexity of negotiated returns in bridge exploits, where attackers can hold funds hostage while demanding both technical fixes and implicit compensation. The key developments to watch are whether Blockstream discloses the terms of any agreement with the attackers, whether the remaining BTC is eventually returned or treated as a bounty, and how this precedent shapes future responses to bridge vulnerabilities across the broader Bitcoin ecosystem.

If you have any feedback or questions about this content, please contact us at crypto.news@kcex.com

The post Hackers Return 85% of Stolen Bitcoin from Last Week’s Bridge Attack appeared on BitcoinEthereumNews.com.

The Liquid hackers returned 3,400 Bitcoin on Monday, most of the roughly 3,998 BTC they moved out of the network over the weekend. Close to 598 BTC stayed behind. Liquid is a Bitcoin sidechain built by Blockstream. Users lock Bitcoin on the main network and receive a matching token, L-BTC, that moves faster and more privately. Blockstream Patched the Bridge Before the Coins Moved The transfer followed a condition the attackers set themselves. They told Blockstream to fix the flaw first and make sure every node running the bridge had been updated. Moving Bitcoin out of the bridge normally takes sign-off from 11 of the 15 companies that run Liquid. The weekend transfer went to a brand new address instead. Blockstream responded within a Bitcoin transaction on Monday morning, signing the message so recipients could verify it came from the company. The bridge nodes were patched, it said, and the funds were safe to send back. The coins moved hours later. Bitcoin’s network recorded the transfer in block 965,950 at 19:09 UTC. Nearly 600 Bitcoin Is Still With the Liquid Hackers About 598.5 BTC remains in the attackers’ address, worth roughly $47 million at Monday’s Bitcoin price near $79,100. Neither side has explained why. That silence is what bothers Charles Guillemet, chief technology officer at hardware wallet maker Ledger, who had already questioned the white hat label on Sunday. So, 3,400 BTC were refunded. The “white hats” still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking! Let’s see what happens to these 600 BTC… https://t.co/nb1p9COmBk pic.twitter.com/BBKLrMVsqd — Charles Guillemet (@P3b7_) September 7, 2026 Follow us on X to get the latest news as it happens BeInCrypto reported on Sunday that Liquid’s peg still balanced after…

Disclaimer: The articles reposted on this website are sourced from public platforms and are for reference only. These articles do not represent the views or opinions of KCEX. All copyrights belong to the original authors. If you believe that any reposted article infringes upon the rights of a third party, please contact crypto.news@kcex.com for removal. KCEX makes no representations or warranties regarding the timeliness, accuracy, or completeness of reposted articles, and shall not be liable for any actions or decisions made based on such content. Reposted materials are for informational purposes only and do not constitute advice, endorsement, or basis for any commercial, financial, legal, and/or tax decisions.