Liquid Network Hackers Return 3,400 BTC, Keep 598.5 BTC

On September 7, 2026, actors who had moved almost the entire Bitcoin reserve of the Liquid sidechain announced the return of 3,400 BTC, valued at roughly $268 million. The network remains paused while operators work to restore the 1:1 backing of L‑BTC.

Background of the incident

On September 6, about 4,000 BTC (approximately $320 million at the time) left the Liquid Federation wallet that backs L‑BTC, representing roughly 95 % of the reserve. Only about 197 BTC remained after the outflow.

Technical cause

Investigations traced the loss to a bug in Elements, the Bitcoin Core fork used by Liquid nodes. A range‑proof verification cache flaw allowed the creation of unbacked L‑BTC tokens, which were then exchanged for real Bitcoin from the reserve. The federation’s signing keys were not compromised; the issue stemmed from token issuance, not custody.

Negotiation and partial return

The actors communicated via Bitcoin OP_RETURN messages, claiming to be “white‑hats” and requesting on‑chain contact. Blockstream responded with PGP‑signed messages, confirming that bridge nodes had been patched and that the funds were “safe to return.” Following this, a transaction sent 3,400 BTC back to the federation address, while the actors retained 598.49955894 BTC. No on‑chain message indicated that the retained amount was a bounty.

Current status of Liquid

The network remains frozen: bridge nodes are disabled, and L‑BTC deposits and withdrawals on centralized exchanges are halted. Other assets issued on Liquid, such as USDT, Depix, and real‑world assets, were not affected. Bitcoin’s main chain continues to operate normally, and Liquid wallets (e.g., Aqua) function only without sidechain features.

Next steps

Operators must demonstrate that any newly issued L‑BTC is fully backed, distribute a patched Elements release, and decide when it is safe to reopen the bridge. The fate of the remaining 598.5 BTC has not been publicly clarified.