Liquid Network $320 Million Bitcoin Hack: Self-Declared

Published September 15, 2026 - New York. Hackers drained roughly 4,000 bitcoin, worth about 320 million dollars, from the federation wallet backing the Liquid Network on September 6, 2026, while claiming to be the good guys - and after days of on-chain negotiation, they returned 3,400 BTC and kept around 598 BTC.

At a glance

• About 4,000 of the 4,200 BTC in the Liquid Federation wallet were withdrawn, roughly 95 percent of its holdings, in the largest hack in the Bitcoin ecosystem in recent years.
• Liquid halted all new transactions, disabled its bridge nodes, and asked exchanges to suspend L-BTC deposits and withdrawals while more than 80 federation members investigated.
• The funds moved out through SideSwap using a Peg-out Authorization Key, yet no key was compromised - Blockstream blamed a software bug in the Elements codebase.
• The actors identified themselves as whitehats in an on-chain message, promised to return most funds after a fix, and returned 3,400 BTC on September 8, keeping roughly 598 BTC worth about 47 million dollars.
• On September 11, Blockstream said it would not pay for the return of the remaining bitcoin.

Data last verified September 15, 2026 from The Register, CoinDesk, Reuters, Bloomberg and ForkLog.

Quick Answer

A software bug, not a stolen key, let self-described white hats walk away with nearly an entire federation reserve - and most of it has already come back. Liquid says purported white-hat hackers withdrew about 4,000 BTC from its federation wallet on September 6 through the approved SideSwap platform. Blockstream attributes the incident to a flaw in the Elements node software rather than any compromised key or hardware. After the bug was patched and nodes updated, the actors returned 3,400 BTC on September 8 and have held on to roughly 598 BTC, which Blockstream now says it will not pay to recover. For L-BTC users the operative question is when normal network activity resumes.

What happened on the Liquid Network

Liquid Network, a Bitcoin sidechain launched in 2018 by Blockstream and now managed by a federation of more than 80 exchanges, infrastructure firms and asset managers, disclosed the incident on X on Sunday, September 6. Purported white-hat hackers had withdrawn roughly 4,000 of the 4,200 BTC held in the federation wallet - about 320 million dollars at then-current prices, and about 95 percent of the reserve backing L-BTC, the token the network issues against locked bitcoin so exchanges can settle faster than on the congested main chain.

The mechanics matter. Liquid said the funds were withdrawn via SideSwap, a settlement platform authorized to handle transfers from the network, using a Peg-out Authorization Key - the mechanism federation functionaries use to recognize destinations authorized to receive peg-outs. significantly, neither SideSwap's key nor any other PAK appeared to have been compromised. That leaves the uncomfortable conclusion that an apparently authorized peg-out path was abused to empty almost the entire wallet, and Blockstream attributed the incident to a software bug in Elements, the open-source codebase Liquid runs on. Summaries of the incident from researchers tracking the case describe the actors exploiting the bug to mint L-BTC without a corresponding increase in bitcoin reserves, then swapping the tokens out for real bitcoin through SideSwap.

Whoever was behind it worked hard to frame the operation as a rescue rather than a robbery. A message embedded in a bitcoin transaction identified them as whitehats and asked Blockstream to make contact. Blockstream responded on-chain with contact details for its security team, and the parties moved to encrypted channels. The actors said they would return most of the bitcoin once the vulnerability was fixed and every node was patched, urging: please fix the bug first, the chain is under risk at the latest commit right now. On September 8 they returned 3,400 BTC, retaining roughly 598 BTC worth about 47 million dollars, around 15 percent of the total. On September 11, Blockstream said it would not pay for the return of the remaining coins.

Who is affected

The direct damage lands on the federation and its users: more than 80 exchanges, infrastructure companies and asset managers who operate the network, and the traders who rely on L-BTC for fast settlement. Blockstream lists major exchanges including BTSE and Bitfinex as Liquid users, and BitMEX, which has announced it is shutting down this month, was also a user. During the response, Liquid wallets were impacted, all new transactions were halted, bridge nodes were disabled, and exchanges were asked to suspend L-BTC deposits and withdrawals.

The incident is also a reputational hit for the sidechain model itself. The security of L-BTC rests on the federation collectively holding bitcoin in reserve; a drain of nearly the entire reserve raises obvious questions about that design. It follows other recent blows to crypto-security confidence, including a 6 million dollar drain from a Crypto.com-linked lending platform on August 31 and an August incident involving the Coldcard hardware wallet.

How to check if you are affected

If you hold L-BTC or traded on Liquid-linked venues, check the status pages of your exchange for L-BTC deposit and withdrawal suspensions, and follow the official Liquid Network account on X for restoration updates. Other assets on the network, including USDT, DePix and several real-world asset tokens, were not affected by the incident.

Be equally alert to fakes: high-profile crypto incidents are immediately followed by phishing that impersonates the victim project. Treat any message about Liquid refunds, compensation or wallet verification with suspicion, and never sign transactions or enter seed phrases on the strength of an unsolicited message.

What to do next

For users and operators in the Liquid ecosystem, the practical checklist looks like this:

• Exchanges and federation members: run only fully patched Elements nodes before restoring services, and validate peg-out authorization behavior end to end.
• Traders: confirm L-BTC services have resumed at your venue before moving funds, and re-verify deposit addresses after the suspension.
• Everyone: rely on official Liquid and Blockstream channels for status, and ignore DMs about the incident.
• Protocol teams: treat the Elements fix as a case study in why reserve-backed sidechains need defense in depth beyond a single authorization mechanism.
• Watch on-chain developments: with about 598 BTC still outstanding and Blockstream refusing to pay, the endgame remains unresolved.

The strangest part of this story is that it could have been far worse. A genuinely malicious actor with the same bug had no obligation to give back 3,400 BTC. The episode still shows how much value sits behind a single federation wallet - and how thin the margin is between a white hat and a very large theft.