3,400 BTC Returned to Liquid's Federation Address. The Actors Kept 598.5 BTC.
Blockstream told the self-described white hats on-chain at 09:41 UTC on September 7, in a message signed with its published security key, that "bridge nodes are patched, safe to return the funds"; the actors asked for the return address to be confirmed again at 12:43 UTC and sent Blockstream an encrypted note at 15:31 UTC. A transaction paying 3,400 BTC to the Liquid Federation's reserve address confirmed in block 965,950 at 16:09 UTC, returning about 85 percent of the 3,996 BTC that left on September 6; the same transaction sends 598.5 BTC back to the actors' address. The federation address now holds about 3,597 BTC against roughly 4,205 L-BTC outstanding before the incident, Blockstream's Liquid explorer shows no new block since 04:49 UTC, and no public Elements release or post-mortem has appeared.
Primary record: mempool.space