White-hat hackers have returned 3,400 of the roughly 4,000 Bitcoin drained from Blockstream's Liquid Network, according to a September 8 update from CoinDesk. That leaves 598 BTC, worth about $47 million at a Bitcoin price near $78,482 as of September 8, 2026, still outside Blockstream's control. The Liquid sidechain remains paused while negotiations continue.
The figure represents roughly 85% of the total loss returned. It is a substantial recovery for an incident that, days ago, looked like one of the larger sidechain failures on record. The remaining gap is the sticking point.
The current state of the recovery
The drain hit Liquid's peg, the mechanism that holds Bitcoin in reserve against the L-BTC that circulates on the sidechain. Earlier reporting traced the root cause to an Elements mint bug, and the initial loss was pegged at close to 4,000 BTC. The parties involved described the actors as white-hats, meaning the return was framed as a negotiated recovery rather than an open theft.
Most of that Bitcoin is now back. The 598 BTC still outstanding is described as native Bitcoin, and Blockstream is continuing negotiations to recover it. The network stays paused in the meantime, which means L-BTC holders cannot rely on normal peg-in and peg-out operations until Blockstream restarts the chain.
A paused sidechain is a blunt safety measure. It stops further movement while the team assesses the peg's health, but it also freezes anyone mid-transaction. For a system whose entire value proposition is faster, confidential Bitcoin settlement, an extended pause is costly to trust even when funds are being returned.
85% back still leaves an unreconciled peg
Recovering the bulk of the funds removes the worst-case outcome, but the last tranche often decides how an incident is remembered. A network cannot cleanly reconcile its peg while a known shortfall sits unresolved. Until the final 598 BTC is either returned or formally written off, Blockstream has to account for a hole in the reserve backing L-BTC.
Negotiations that reach 85% and then stall are common in exploit recovery. The initial return is usually the amount the counterparty is willing to give up quickly to reduce legal exposure. The remaining balance is where leverage, disputed terms, or a bounty demand tend to concentrate. The public update does not disclose whether a bounty is on the table for the outstanding portion, so the terms of the final stretch are not yet clear from the source.
For anyone holding L-BTC or routing value through Liquid, the practical question is settlement risk, not headline recovery. The peg is only as sound as the Bitcoin actually sitting behind it. An 85% return with the chain paused is progress, but it is not a restored peg.
The custody lesson underneath the headline
Liquid is a federated sidechain, which means a defined group of functionaries holds the Bitcoin reserve and signs off on peg operations. That design trades some of Bitcoin's trust-minimization for speed and confidentiality. When the reserve is compromised, users are exposed to the recovery competence and negotiating position of that federation, not to their own keys.
This is the same counterparty exposure that shapes decisions across crypto spending and custody. Bitcoin that lives inside a bridge, a sidechain peg, or a custodial account depends on the operator's controls and its ability to claw funds back when something breaks. For readers weighing where their Bitcoin sits, incidents like this are a reminder that spending from your own wallet carries a different risk profile than trusting a pooled reserve, whatever the convenience tradeoff.
Broader context matters here too. CNBC reported the same week that crypto platforms have lost more than $3.63 billion to cyberattacks, and that many of the affected platforms had passed security audits. An audit is a snapshot, not a guarantee, and a mint bug in production code is exactly the kind of failure that clean audits miss.
The takeaway for Liquid users
The immediate signal is directional and positive: most of the Bitcoin is back, and the actors are cooperating. The unresolved signal is the paused network and the $47 million gap. Neither closes until Blockstream either recovers the final 598 BTC or restarts the chain with a documented plan for the shortfall.
Watch for two specific events. First, a Blockstream statement confirming the network has resumed peg-in and peg-out operations. Second, disclosure of what happens to the outstanding 598 BTC, whether returned, bountied, or absorbed. Until then, treat Liquid's peg as functioning under supervision rather than fully restored.
Overview
White-hat hackers have returned 3,400 of about 4,000 BTC drained from Blockstream's Liquid Network, roughly 85% of the loss. The remaining 598 BTC, worth around $47 million as of September 8, 2026, is still outstanding, and the sidechain stays paused while negotiations continue. Most funds are recovered, but the peg is not reconciled until the final tranche is resolved.
