Liquid Network hackers return 3,400 BTC after exploit, keep $47 million

On September 6, 2026, exploiters drained 4,000 Bitcoin ($320 million) from Blockstream's Liquid Network, taking 95% of its reserves and breaking the 1:1 backing of L-BTC. The exploit leveraged a range-proof bug in the Elements codebase. Following on-chain negotiations, the self-described white-hat hackers returned 3,400 Bitcoin but retained 598.5 Bitcoin ($47 million). The network remains paused as operators deploy patches and prepare for a coordinated restart.

Liquid Network bitcoin exploit

• ▪The exploit was executed via SideSwap's Peg-out Authorization Key, but representatives from Liquid Network and SideSwap stated the key itself was not compromised.
• ▪An exploit on Sunday, September 6, 2026, drained approximately 4,000 Bitcoin, worth roughly $320 million, from the Liquid Network federation wallet.
• ▪The unauthorized withdrawal of 4,000 Bitcoin from the Liquid Network federation wallet represented approximately 95% of the network's total reserves.

Elements software vulnerability

• ▪The exploiters conducted a 2.5 Bitcoin dry run before sending roughly 4,000 Liquid Bitcoin to SideSwap's peg-out service at 14:05 UTC on September 6, 2026.
• ▪The security vulnerability originated from a bug in Elements, the open-source codebase and Bitcoin Core fork that powers Liquid Network nodes.
• ▪Technical reconstructions indicate a range-proof verification cache bug in Elements allowed the actors to mint unbacked Liquid Bitcoin that was subsequently exchanged for real Bitcoin.

Partial return of stolen funds

• ▪The exploiters retained 598.5 Bitcoin, valued at approximately $47 million, which remained in their address as of September 8, 2026.
• ▪Ledger Chief Technology Officer Charles Guillemet stated that if the retained 600 Bitcoin was a negotiated reward, the arrangement resembled extortion rather than white-hat hacking.
• ▪The exploiters returned 3,400 Bitcoin, worth approximately $270 million, to the Liquid Network federation wallet on Monday, September 7, 2026.

Network suspension status

• ▪Other digital assets issued on the Liquid Network, including Tether, DePix, and tokenized real-world assets, were unaffected by the security breach.
• ▪Liquid Network operators suspended all network transactions, disabled bridge nodes, and paused the network following the September 6, 2026 exploit.
• ▪JAN3 CEO Samson Mow advised users on September 7, 2026, not to send Bitcoin to Liquid peg-in addresses until the network restart is officially confirmed.

L-BTC backing shortfall

• ▪The extraction of 4,000 Bitcoin left only 197 Bitcoin in the Liquid Network federation wallet, causing Liquid Bitcoin to lose its 1:1 collateralization backing.
• ▪Liquid Network is managed by a federation of more than 80 exchanges, infrastructure companies, and asset managers, which must coordinate to restore the 1:1 backing.

Whitehat hacker communication

• ▪The exploiters communicated publicly with Blockstream by writing cryptographically signed and PGP-encrypted messages within Bitcoin blockchain transactions.
• ▪The exploiters conditioned the return of the funds on Blockstream patching the Elements vulnerability and ensuring all network nodes were updated.

Debatable claims

• ▪The Liquid Network hackers should be classified as extortionists rather than white-hats
• ▪The Liquid Network exploit exposes fundamental security flaws in the Bitcoin sidechain model