White-hat hackers drain $320 million in Bitcoin from Liquid Network, promise return after patch

On September 6, 2026, an unidentified party drained roughly 4,000 Bitcoin ($320 million) from Blockstream's Liquid Network federation wallet. The exploit leveraged a bug in the Elements software to mint unbacked Liquid Bitcoin, which was then processed through SideSwap's peg-out service. Claiming to be white-hat hackers, the actors demanded a patch before returning funds. After Blockstream deployed a fix, the hackers returned 3,400 Bitcoin but retained nearly 600 Bitcoin ($47.3 million).

Liquid Network Bitcoin drainage

• ▪The withdrawal of approximately 4,000 Bitcoin represented roughly 95% of the 4,200 Bitcoin held in the Liquid Network federation wallet prior to the incident.
• ▪An unidentified party withdrew approximately 4,000 Bitcoin, valued at roughly $320 million, from the Liquid Network federation wallet on September 6, 2026.

Elements software bug exploitation

• ▪The unauthorized peg-out transaction was signed by 11 of the Liquid Network federation's 15 functionary keys, satisfying the network's greater than two-thirds threshold.
• ▪The Elements software bug allowed Liquid Bitcoin to be created without corresponding Bitcoin backing, which then successfully entered the valid peg-out process.
• ▪Blockstream traced the unauthorized creation of the 4,000 Liquid Bitcoin used in the withdrawal to a software bug in Elements, the open-source software underlying the Liquid Network.

White-hat hacker communication protocol

• ▪Blockstream contacted the party behind the withdrawal through an on-chain transaction at block 965,822, requesting them to contact Blockstream's security team.
• ▪The party behind the withdrawal promised to return the funds on the condition that Blockstream first fix the Elements software bug and ensure every node is patched.

Conditional fund return promise

• ▪Following a PGP-signed message from Blockstream confirming that bridge nodes were patched, the party returned 3,400 Bitcoin to the federation address in block 965,950.
• ▪The party behind the withdrawal retained approximately 598.5 Bitcoin, worth about $47.3 million, in their wallet after returning the 3,400 Bitcoin.
• ▪The party behind the withdrawal promised to return the funds on the condition that Blockstream first fix the Elements software bug and ensure every node is patched.

SideSwap peg-out authorization mechanism

• ▪Liquid Network and SideSwap stated that neither SideSwap's Peg-out Authorization Key nor any other federation keys were compromised during the incident.
• ▪The unauthorized withdrawal was processed through SideSwap's peg-out service using a valid Peg-out Authorization Key.

Network suspension response

• ▪Liquid Network temporarily disabled its bridge nodes and effectively paused the sidechain to prevent new transactions during the investigation.
• ▪Cryptocurrency exchanges suspended Liquid Bitcoin deposits and withdrawals in response to the security incident, while other Liquid assets like USDT remained unaffected.

Debatable claims

• ▪Federated sidechains pose unacceptable security risks for Bitcoin
• ▪Retaining millions in unauthorized bounties disqualifies hackers from white-hat status