Hackers Return 85% of Bitcoin Stolen in Bridge Attack

Hackers behind last week’s Bitcoin bridge attack have returned roughly 85% of the stolen BTC, according to the reported figure, leaving about 15% still outside that recovery. The claim remains unconfirmed pending on-chain verification, transaction records, and any official statement from the affected bridge.

Hackers Return 85% of Bitcoin Stolen in Bridge Attack

The core claim in this Bitcoin bridge attack story is a partial return: attackers are reported to have sent back about 85% of the Bitcoin taken in an incident described as occurring last week. No bridge name, transaction hashes, total loss figure, or precise dates accompany that claim in the available evidence. For related coverage, see Bitcoin Warning: Weekend Could Be 'Highly Eventful'.

What the Reported 85% Return Covers

The percentage describes only the share of stolen assets said to have been returned. Whether the moved asset was native Bitcoin or a wrapped representation, and the exact BTC denominator, cannot be confirmed here. A broadly similar pattern was documented by reporting on the Liquid exchange incident, where attackers returned a large tranche of Bitcoin, though that is a separate event and not confirmation of this one. For related coverage, see Pair of US arrests in connection with Bitfinex hack, recovers $ three.six billion in Bitcoin.

Attack and Return Timeline

The only timing marker available is the phrase “last week,” which is not a verified date and should be replaced once dated records surface. On-chain confirmation would require tracing the return transactions through a block explorer such as Mempool.space, which has not yet been supplied for this incident. For related coverage, see US Expands Iran-Linked HBO Bitcoin Ransom Case to 17 Defendants.

What Is Known About the Remaining 15%?

Subtracting the reported 85% return from the full total leaves 15% outside that recovery. That 15% is arithmetic derived from the headline figure, not an independently verified balance sitting in any identified wallet.

The Share Outside the Reported Return

There is no evidence describing the location or final disposition of the remaining share. It should not be characterized as an agreed bounty, as permanently lost, or as still controlled by the attackers without supporting records. Prior bridge exploits, such as the Harmony Horizon bridge attack attributed to a North Korean hacker, show how attribution and fund tracing can take considerable time.

Return Terms Remain Unconfirmed

No bounty, negotiated settlement, or frozen-funds detail is available to explain why the reported return happened. Settlement terms should be reported only once attributable evidence appears. Cross-chain bridges have repeatedly proven fragile, as seen in the Polkadot bridge hack that triggered a DOT price plunge.

What the Bitcoin Return Means for Affected Users

A reported return of assets is not the same as users being made whole. The 85% figure alone does not establish that affected users have received any funds.

Reimbursement and Withdrawal Status

There is no information on repayment plans, withdrawal availability, or how returned Bitcoin would be distributed. These remain open questions. Past recoveries, including the $3.6 billion Bitfinex hack seizure, show that recovering coins and returning them to users are distinct steps.

Bridge Security and Next Updates

Nothing in the available evidence confirms the bridge has resumed operations or is safe to use. The updates worth watching next are an official statement identifying the bridge, on-chain records of the return transactions, and a reimbursement plan for affected users.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.