The group of hackers who withdrew 4,000 BTC from the Liquid Network has returned 3,400 BTC ($269.2 million), equivalent to 85%, but has kept nearly 600 BTC.

The group calling itself “white-hat hackers” behind the withdrawal of about 4,000 BTC from the Liquid Network has returned 3,400 BTC, worth about $269.2 million, to the alliance wallet of the sidechain on Monday, thereby recovering about 85% of the funds. Despite most of the money being returned, around 598.5 BTC, worth about $47 million, is still sitting in addresses associated with the withdrawal.

The incident began on Sunday, when a customer transferred 4,000 L-BTC to SideSwap’s asset-withdrawal service from the peg-out. The perpetrators later called themselves “white-hat hackers” in a message attached to the Bitcoin transaction.

However, Ledger’s Chief Technology Officer, Charles Guillemet, remained skeptical of the claim even after most of the funds had been returned, saying the group’s continued retention of 600 BTC looks more like extortion than a typical white-hat attack—especially if this was a bounty negotiated via an on-chain encoded contract.

Liquid has not yet finished processing the collateral shortfall

After the withdrawal incident, Liquid disabled the bridge nodes and asked exchanges to temporarily suspend deposits and withdrawals of L-BTC. The repayment took place after a series of messages exchanged via Bitcoin transactions between the hacking group and Blockstream, the developer of the Liquid sidechain.

The group asked Blockstream to patch the bug and confirm that all nodes have been updated before safely committing to repay the money. After Blockstream sent a signed message confirming that the bridge nodes had been patched, the hackers transferred 3,400 BTC to the Liquid Alliance address—even though they had previously only requested repayment of “most” of the Bitcoin and did not publicly disclose why they kept the remainder.

So far, the Liquid network has not said whether the remaining ~600 BTC is going to be returned, nor how the shortfall in collateral for L-BTC will be handled, or when the sidechain and asset-needing services will resume normal operation. Blockstream did not immediately respond to Decrypt’s request for comment.