Most of the bitcoin taken from Liquid Network in a $320 million exploit has been returned, but the Bitcoin sidechain is still frozen and tens of millions of dollars remain unaccounted for.
Liquid Network, a federated Bitcoin sidechain launched in 2018 by Blockstream, the blockchain company co-founded by cryptographer Adam Back, was hit on Sunday when attackers withdrew roughly 4,000 of the 4,200 BTC held in the federation wallet that backs its token, L-BTC. At the time, the haul was valued at about $320 million. The network responded by halting new transactions and disabling its bridge nodes, effectively pausing the sidechain until the issue could be resolved. Liquid said federation members were working to restore normal network activity and apologized for the impact on Liquid wallets.
Blockstream attributed the incident to a software bug in Elements, the codebase underpinning the sidechain, rather than to compromised keys. Security specialists described the flaw as sitting at the node level in Liquid's transaction software, not as a breach of keys or hardware security modules, and the affected funds moved through the approved SideSwap trading platform.
What followed was an unusual public negotiation conducted directly on the Bitcoin blockchain. The group behind the withdrawal used the OP_RETURN data field in Bitcoin transactions to send messages, first writing "contact us on chain" from the address holding the 4,000 BTC. A Blockstream-linked address replied by asking the group to make contact via email. In another message, the group asked that the vulnerability be patched before any funds moved, saying every node needed to be updated first and that the money would then be transferred back safely.
After Blockstream signaled that the affected bridge nodes had been patched and that funds were safe to return, a transaction confirmed at 16:09 UTC on September 7, in Bitcoin block 965,950, sent 3,400 BTC back to the labeled Liquid peg script address. That amounted to roughly 85% of the withdrawn coins, valued at about $268 million to $269 million when confirmed. The remaining 598.5 BTC, worth roughly $47 million, was sent back to the address controlled by the self-described white-hat party as change.
Samson Mow, a prominent bitcoin advocate and former chief strategy officer at Blockstream who has been publishing status updates on the incident, said Monday that roughly 598 BTC remains outstanding and that Blockstream continues to engage with the group. He added that the network remains paused while Blockstream and federation members make additional fixes and security improvements, resolve a chain split, and prepare for a safe restart, including work to ensure L-BTC is fully backed before the network comes back online.
The "white hat" framing has drawn scrutiny. Ethical hackers typically identify and report vulnerabilities so developers can fix them, often receiving a bounty under terms agreed in advance with the affected project. In this case, no publicly disclosed agreement has established that the actors had permission to withdraw the funds, and neither Blockstream nor the group has published terms granting a bounty or allowing the retention of nearly 600 BTC.
The stakes extend beyond one protocol. Liquid is designed to let exchanges settle bitcoin transactions quickly by issuing L-BTC against BTC locked on the platform, with blocks roughly every minute and finality in about two minutes. It is overseen by a federation of more than 80 exchanges, infrastructure providers and asset managers, and exchanges that use it include BTSE and Bitfinex. Liquid has not announced when its bridge and L-BTC services will resume normal operations.
The episode is the latest in a string of security incidents this year, following a roughly $6 million drain last week from a lending platform linked to Crypto.com and an August breach involving the Coldcard hardware wallet.
This is a news summary for general information only — not financial advice, and nothing here is a recommendation to buy, sell, or hold any asset. Always verify against the original source and do your own research before making a financial decision.
Source: CoinDesk · 2026-09-08
