# Liquid recovery transfer returns 3,400 BTC as restart preparations continue

Canonical: https://chainincident.com/news/89f405ee-3125-4f46-9352-49d8f6ca8c8a
Published: 2026-09-08T05:34:09.778Z
Publisher: Chain Incident

A confirmed Bitcoin transaction returned 3,400 BTC to the reported Liquid Federation address. Blockstream says updated software is deployed as members prepare a restart.

A Bitcoin transaction associated with the Liquid Network recovery returned 3,400 BTC on September 7. The transfer was confirmed in block 965,950 at 16:09 UTC, according to the block explorer record. The receiving address is identified as the Liquid Federation peg wallet in Bitquery’s published investigation. [Transaction record](https://mempool.space/tx/a6d697a25266ce3c78774fd1d75f896b7af522ada209b0f6228ea497bc49a46d), [Bitquery’s investigation and transaction references](https://bitquery.io/investigations/liquid-network-hack-4000-btc-op-return).

The same transaction sent approximately 598.5 BTC back to its sending address. That is an output recorded at the time of the transfer, not a claim about the address’s current balance or an agreed reward. The transaction establishes a movement of funds; it does not establish the actors’ motives or the terms of any private agreement. [On-chain outputs](https://mempool.space/tx/a6d697a25266ce3c78774fd1d75f896b7af522ada209b0f6228ea497bc49a46d).

In a separate update dated September 7, Blockstream said updated software had been deployed and Liquid Federation members were preparing a coordinated restart. It said work to harden the network and secure the return of assets was continuing. The statement did not announce a completed restart or specify when normal service would resume. [Blockstream update](https://www.reddit.com/r/blockstream/comments/1waaan2/liquid_network_update_september_7_2026/).

Liquid operates as a separate Bitcoin sidechain, built with Elements software and connected to Bitcoin through a two-way peg. Its federation model and operating rules differ from Bitcoin’s base layer. A problem affecting Liquid’s backing or operation should therefore be described at that scope, rather than as a compromise of Bitcoin consensus. [Liquid technical documentation](https://docs.liquid.net/docs/technical-overview).

For services integrating Liquid, asset recovery and service restoration are separate milestones. The confirmed transfer answers how much moved in that transaction. Restart confirmation and a technical incident report are still needed to assess restored functionality and the cause of the incident.

## Sources

- [Liquid Network gets back 3,400 bitcoin from whitehat hackers; talks underway for the rest](https://www.coindesk.com/markets/2026/09/08/white-hat-hackers-return-most-of-usd320m-bitcoin-taken-from-liquid-network) — CoinDesk
- [Liquid ‘white hats’ return $270M in Bitcoin as network prepares restart](https://cointelegraph.com/news/liquid-white-hats-return-270m-bitcoin-network-restart) — Cointelegraph

- [Editorial policy](https://chainincident.com/editorial-policy)
- [Request a correction](https://chainincident.com/corrections)