3,400 BTC BACK. ABOUT $47M STILL OUT.

Three thousand four hundred bitcoin came back. That is the number on the return. The actors who drained Liquid Network on Sunday, 6 September, sent 3,400 BTC to the federation wallet on Monday. About 598.5 BTC, worth about $47 million on the desks that priced it, stayed with them. This Extra files those two piles. It does not invent a third.

Decrypt put the return at 3,400 BTC, about $269.2 million on its tape, roughly 85 percent of what left. It left nearly 600 BTC outstanding. Bitcoin.com, same incident, said 3,400 BTC worth about $268 million came back and 598.5 BTC, $47 million, did not. The dollar legs move with the coin. The coin counts are the spine: 3,400 back, about 598.5 still out. Check: decrypt.co/377600/liquid-hackers-return-270m-bitcoin and news.bitcoin.com/security/liquid-hackers-return-3400-btc-keep-47m-as-network-stays-frozen/

What happened, as those desks logged it: Liquid is a Bitcoin sidechain. L-BTC is supposed to be backed one-for-one by BTC in a federation wallet. On 6 September a peg-out through SideSwap, a federation member, moved on the order of 4,000 BTC out of that wallet — about $320 million, about 95 percent of the reserve, leaving roughly 197 BTC behind. SideSwap said its own systems were not breached. Liquid said federation keys were not stolen. The hole they named is a bug in Elements, the software the nodes run, that let unbacked L-BTC be created and then redeemed for real BTC. That mechanism is their account. This Extra does not reverse-engineer the code.

The actors called themselves white hats, on-chain. Blockstream, which built Liquid, answered in PGP-signed messages in the same channel. After a signed line that the bridge nodes were patched and it was “safe to return the funds,” 3,400 BTC moved back to the federation address. Decrypt recorded Blockstream’s patch message as the trigger for the return. Bitcoin.com recorded the same sequence: patch first, then the 3,400. Neither desk published a signed bounty contract for the remainder.

What the return means, and what it does not. It means most of the reserve that walked out on Sunday is sitting in the federation wallet again. L-BTC is closer to being backed than it was when the wallet was almost empty. It does not mean Liquid is open. Both Decrypt and Bitcoin.com said the network stayed paused, bridge nodes down, exchange deposits and withdrawals of L-BTC still halted, no restart time announced. A return of coins is not a reopening of a bridge.

It also does not mean the remaining ~598.5 BTC is a legal bounty. Decrypt quoted Ledger CTO Charles Guillemet: if this was ever a negotiated reward under an encrypted on-chain contract, it looks more like extortion than white-hat hacking. That is his claim, attributed. Liquid has called the actors purported white-hats. The actors have not, on the files used here, published why they kept the 15 percent. This Extra will not call it a fee.

Decrypt’s later wrap, 8 September, said Blockstream was still talking to recover the rest. Liquid, on that file, did not give terms or a date. This Extra does not invent a deadline. It does not name the attackers. It does not print a wallet dump.

For holders of L-BTC the practical file is ugly and simple. Most of the backing BTC is back. Some is not. The peg is not running while operators patch, argue about a chain split, and decide when 1:1 is true again. Bitcoin.com said a restart may require proving legitimate L-BTC is backed. That is a to-do list, not a done list.

Nailed down: 3,400 BTC returned to the Liquid federation wallet after the 6 September drain; about 598.5 BTC, about $47 million, still with the actors; original take on the order of 4,000 BTC; Elements bug as the operators’ cause; keys not reported stolen; network still paused as of 7–8 September. Sources: Decrypt; Bitcoin.com. White-hat is what they called themselves. It is not a court finding.

DESK_ID liquid-network-hack-3400-btc-returned. Verification: Decrypt, 7–8 September 2026, decrypt.co/377600/liquid-hackers-return-270m-bitcoin and decrypt.co/377723/liquid-hack-47m-blockstream-bargains-white-hat ; Bitcoin.com, 7 September 2026, news.bitcoin.com/security/liquid-hackers-return-3400-btc-keep-47m-as-network-stays-frozen/ . Graphic: NTH MERIDIAN DESK. No X post. NTH MERIDIAN does not invent counts.