TLDR
- Whitehat hackers returned 3,400 of the 4,000 BTC stolen from Liquid Network’s federation wallet on Sunday
- About 598 BTC, worth roughly $47 million, is still outstanding
- The hack drained nearly all of Liquid’s 4,200 BTC reserve, leaving L-BTC far from fully backed
- Blockstream communicated with hackers through signed messages embedded in Bitcoin transactions
- The network remains paused while security fixes, a chain split, and restart preparations continue
Liquid Network, a Bitcoin sidechain built by Blockstream, was hit on Sunday when attackers drained about 4,000 Bitcoin from its federation wallet. That wallet backs L-BTC, the network’s native token, on a one-for-one basis.
UPDATE: 🚨 The Liquid Network "white hat" hackers returned 3,400 BTC of 4,000 BTC after communicating on-chain with Blockstream, seemingly keeping 598.5 BTC for themselves, per Galaxy Research's Alex Thorn. pic.twitter.com/w3GUpOqUrA
— CoinMarketCap (@CoinMarketCap) September 7, 2026
The attack left just 197 BTC in the reserve, out of a previous balance of around 4,200 BTC. That left L-BTC without full backing almost instantly.
Operators moved quickly. They disabled bridge nodes, paused the network, and asked exchanges to freeze L-BTC deposits and withdrawals. Other tokens on Liquid, including tether, were not affected.
The attackers identified themselves as whitehats. They said they would return the funds once the vulnerability was fixed and all nodes had installed the patch.
Blockstream responded by embedding signed messages directly into Bitcoin transactions. The two sides negotiated publicly on-chain.
Hackers Return Most of the Bitcoin
After Blockstream confirmed the bridge nodes had been patched, the group transferred 3,400 Bitcoin back to the federation wallet. That represents about 85% of what was taken.
JAN3 CEO and former Blockstream executive Samson Mow confirmed the return on Monday. He said roughly 598 BTC remains outstanding and that Blockstream is still in talks with the group.
At current prices, the returned Bitcoin is worth around $270 million. The 598 BTC still held by the hackers is worth approximately $47 million.
The original withdrawal was processed through SideSwap’s Peg-out Authorization Key. Both Liquid and SideSwap said the key itself was not compromised.
SideSwap said the vulnerability came from a bug in Elements, the open-source software that underpins Liquid.
Questions Over “Whitehat” Label
Not everyone is comfortable calling the hackers whitehats. Ledger’s chief technology officer Charles Guillemet raised concerns after only a partial return.
He said that if the remaining 600 BTC represented some kind of negotiated reward, the arrangement looked more like extortion than ethical hacking.
Blockstream has not publicly described the outstanding Bitcoin as a bounty. The company has not disclosed any repayment terms either.
The network remains paused as of Monday. Blockstream and federation members are still working through additional security fixes, resolving a chain split, and preparing for a coordinated restart.
Mow said no user action is needed at this time. He also warned users not to send Bitcoin to Liquid peg-in addresses until the network restart is confirmed.
Updated software has already been deployed. Federation members are preparing for a coordinated restart once all conditions are met.
