Liquid Network Hacker Returns 3,400 Bitcoin, Keeps 15%

A hacker tied to the Liquid Network has reportedly returned 3,400 Bitcoin while keeping 15% of the haul, according to the story making the rounds this week. The entity attribution, the figures and the terms of the return all remain unconfirmed, and no transaction record has been supplied to verify the transfer.

Hacker reportedly returns 3,400 Bitcoin

What the headline reports

The reported return names Liquid Network as the affected party. As reported by Crypto Briefing, a hacker returned the bulk of a Bitcoin haul, but no wallet address, timestamp or recipient has been confirmed alongside the figure. For related coverage, see Liquid Network Releases 3,996 BTC After L-BTC Burn.

The affected organization should be verified before the claim is treated as settled. Liquid Network is Blockstream’s Bitcoin sidechain, and it should not be conflated with any similarly named exchange or service. Prior coverage of the network’s Bitcoin movements, including a report that WatcherGuru flagged a roughly 4,000 BTC withdrawal, remains the most relevant on-site context for the current claim. For related coverage, see Nearly 4,000 BTC Leaves Liquid Through Valid Peg-Out.

No block explorer entry has been provided to trace the reported transfer. Readers can monitor Bitcoin network activity directly via Mempool.space, but no transaction hash for this specific return has been established.

Hacker reportedly keeps 15% of the haul

Retained funds and return terms

The headline says the hacker kept 15% of the haul. That figure is attributed to the reporting only, and no source has established the original stolen total or the basis for the percentage.

The retained funds should not be described as a bounty, reward or negotiated settlement. Nothing in the available evidence points to an agreement, and the relationship between the returned and retained amounts is unconfirmed. The original haul and the retained Bitcoin figure cannot be reliably calculated from the headline numbers alone.

What remains unconfirmed about the reported Bitcoin return

Confirmation of recovery and incident status

No official statement, incident timeline or information on user losses has been supplied. Blockstream’s own channels, including the Blockstream blog, would be the primary venue for any confirmation of the affected entity, the asset, the returned amount and the recipient’s control of the funds.

Confirming the incident requires evidence on several fronts: the affected entity and asset, verified on-chain records of the return, the retained share, and whether the recipient controls the returned coins. Related on-site reporting has noted that Blockstream described the Liquid bridge as patched after an exploit, and separate accounts have examined whether a near-4,000 BTC release followed a federation node dispute rather than a hack.

Until reimbursement, remaining losses, service restoration or security fixes are documented, none should be presented as fact. The reported transfer is not the same as a verified recovery or a resolved incident.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.