Liquid Gets 3,400 BTC Back, 598.5 BTC Still Missing

A single Bitcoin transaction returned 3,400 BTC to Liquid Network’s federation wallet at 16:09 UTC on Sept. 7, 2026, one day after a self-described white-hat actor pulled roughly 4,000 BTC through the sidechain’s peg-out system, restoring most reserves but leaving L-BTC materially underbacked. The on-chain return transaction was nearly three times the 1,144 BTC Liquid reported across all 1,201 peg-outs in the first quarter, a useful normal-activity baseline, and reversed about 85% of the incident outflow.

What moved—and what did not?

The 3,400 BTC moved directly from the actor’s address to the federation reserve rather than through a bridge into Liquid or onward to a trading venue. Another 598.5 BTC was returned as change to the actor’s address and remained there as of Sept. 8; neither the transfer nor the available public messages establish that this amount was an agreed bounty.

The original movement began when 4,000 L-BTC reached SideSwap’s peg-out service at 14:05 UTC on Sept. 6. SideSwap burned the tokens using a valid Peg-out Authorization Key, and the federation released approximately 3,996 BTC on Bitcoin 23 minutes later. Blockstream’s incident notice says the SideSwap key and other signing keys were not compromised.

Instead, SideSwap said an Elements software bug created L-BTC without matching collateral. Technical reconstructions cited by TRM Labs’ incident analysis point to faulty caching of confidential-transaction range-proof verification. The federation’s signers therefore treated the invalid L-BTC as spendable and honored its peg-out.

Why does the remaining 598.5 BTC matter?

The shortfall is system-critical for L-BTC but is not yet a broad Bitcoin sell-side event. Liquid held roughly 4,200 BTC before the withdrawal; the returned 3,400 BTC equals about 81% of that pool, while identified reserves of roughly 3,597 BTC imply only about 86% backing against an estimated 4,200 L-BTC outstanding. That is far below the documented one-BTC-per-L-BTC design.

The retained coins have not been identified as an exchange deposit, sale or bridge movement. Until that changes, their market significance lies in the roughly 14% reserve gap and impaired redeemability, not assumed spot-BTC selling pressure.

What should traders watch next?

Over the next 24 to 72 hours, traders should not treat L-BTC parity as assured until Liquid restarts peg-outs and publishes a reserve-to-liability reconciliation. The decisive measurement is the combined federation reserve versus issued L-BTC: restoration to 100% backing would invalidate the shortfall thesis, while movement of the retained 598.5 BTC into a tagged exchange wallet would invalidate the current view that the incident poses no immediate spot-selling threat.