Hackers Return 85% of Stolen Bitcoin from Last Week’s Bridge Attack 

The Liquid hackers returned 3,400 Bitcoin on Monday, most of the roughly 3,998 BTC they moved out of the network over the weekend. Close to 598 BTC stayed behind. Liquid is a Bitcoin sidechain built by Blockstream.

Users lock Bitcoin on the main network and receive a matching token, L-BTC, that moves faster and more privately. Blockstream Patched the Bridge Before the Coins Moved The transfer followed a condition the attackers set themselves.

They told Blockstream to fix the flaw first and make sure every node running the bridge had been updated. Moving Bitcoin out of the bridge normally takes sign-off from 11 of the 15 companies that run Liquid. The weekend transfer went to a brand new address instead.

Blockstream responded within a Bitcoin transaction on Monday morning, signing the message so recipients could verify it came from the company. The bridge nodes were patched, it said, and the funds were safe to send back. The coins moved hours later.