Liquid hack: $47M still missing as Blockstream negotiates

Blockstream is negotiating with a group of self-described ‘white hat’ actors to recover about $47 million that remains unaccounted for after a recent security breach of the Liquid Bitcoin sidechain.

Liquid is a federated sidechain operated by Blockstream and run by a network of functionary nodes. Exchanges and trading firms use Liquid for faster, off-chain Bitcoin settlement and pegged transfers between Bitcoin and the sidechain token.

After the exploit, some coins were recovered or frozen, but roughly $47 million has not been traced to addresses controlled by the network or affected parties. Blockstream opened direct talks with individuals who claim they moved or now control portions of the funds, seeking a technical and legal process for transferring assets back to federation-controlled addresses or to the original owners.

The company and Liquid’s federation have coordinated an incident response that includes forensic analysis of blockchain transactions, cooperation with exchanges and custodians, outreach to law enforcement, and work with security researchers and third-party blockchain analytics firms to trace fund flows and identify any laundering or swaps.

The actors described as ‘white hats’ reportedly intervened after the initial theft and moved some funds to addresses they control, a tactic sometimes used to prevent theft proceeds from being dispersed. Negotiations are focused on the mechanics of returning the coins and on whether any compensation or fees will be required for the transfer.

Some exchanges temporarily halted Liquid deposits and withdrawals while federation members assessed network integrity and implemented fixes. Blockstream is working to patch the vulnerability that allowed the exploit and to bolster operational controls, but it has not published a full technical breakdown because the investigation is ongoing.

The final recovery total remains unclear. Ongoing forensic work and the outcome of negotiations will determine how much of the $47 million can be retrieved. The company and federation are advising users to monitor official channels and addresses associated with the incident for updates.