Blockstream's Liquid Network Loses ~4,000 BTC to Elements Bug, White Hats Return 3,400 BTC
Attackers exploited a software bug in Blockstream's Liquid Network to peg out roughly 4,000 BTC, returned 3,400 BTC after claiming to be white hats, and kept about 598.5 BTC.
Read this event in русский, 日本語, français, español, 한국어, 中文（中国）, Indonesia
Why it matters
The incident exposed a critical vulnerability in Blockstream's federated sidechain model, halted Liquid Network operations and LBTC deposits/withdrawals across exchanges, and raised unresolved legal questions about whether retaining the unreturned BTC constitutes theft or a security bounty.
Where the sources disagree
Root cause description of the bug
inflation bug on the LBTC sidechain
Bitcoin Magazine
range-proof verification cache bug / cache-key collision in confidential transactions logic
Crypto.News
Sources describe the underlying flaw differently: an inflation bug (Bitcoin Magazine) versus a range-proof verification cache/cache-key collision bug (Crypto.News), both in the Elements codebase.
Key facts
Purported white-hat hackers withdrew approximately 4,000 BTC from Blockstream's Liquid Federation wallet.
4,000 BTCDisputed figureReported by Bitcoin Magazine
The withdrawn amount was valued at approximately $320 million.
320,000,000 USDReported by Bitcoin Magazine
The withdrawal used SideSwap's Peg-out Authorization Key, which itself was not compromised.
Reported by Bitcoin Magazine
The attackers returned 3,400 BTC to the Liquid federation wallet on Monday after Blockstream confirmed bridge nodes were patched.
3,400 BTCReported by CryptoPotato
Approximately 598.5 BTC (about $47 million) remained unreturned, with Blockstream still negotiating recovery.
598.5 BTCReported by CryptoPotato
The exploit stemmed from a bug in Liquid's underlying Elements software that allowed creation of unbacked L-BTC tokens.
Reported by CryptoPotato
The federation wallet held roughly 4,200 BTC before the incident, leaving a little over 207 BTC (or 197.47 BTC per another source) afterward.
4,200 BTCDisputed figureReported by Bitcoin Magazine
Liquid Network halted its sidechain and bridge nodes following the incident.
Reported by Bitcoin Magazine
What happened
On September 6, 2026, Blockstream's Liquid Network federation wallet lost roughly 4,000 BTC (reported variously as 3,998, 3,998.49748445, or 4,019.4 BTC across sources), worth about $320 million, in a peg-out transaction using SideSwap's Peg-out Authorization Key. Liquid and SideSwap said no federation keys or the PAK itself were compromised; instead a bug in the Elements software (described by Crypto.News as a range-proof verification cache/cache-key collision) allowed unbacked L-BTC to be minted and exchanged for real reserve BTC. The actors identified themselves on-chain via an OP_RETURN message as "whitehats," negotiated with Blockstream, and after Blockstream confirmed bridge nodes were patched, returned 3,400 BTC on Monday (worth about $270 million per Unchained), while retaining roughly 598–600 BTC (about $47 million) as of the latest reports. As of Decrypt's September 8 report, Blockstream was still in talks with the individuals to recover the remaining funds, and the network remained paused/frozen.
How the story developed
- Update
Attackers withdraw ~4,000 BTC from Liquid Federation wallet via SideSwap peg-out
Two transactions confirmed in Bitcoin blocks 965780 and shortly after, moving nearly all BTC backing L-BTC.
- Official statement
Liquid Network confirms breach and pauses sidechain
Liquid posted an official account on X acknowledging the withdrawal of ~4,000 BTC (~$320 million) and disabled bridge nodes.
- First report
First report by Bitcoin Magazine
Alleged White-Hat Hackers Withdraw 4,000 bitcoin from Blockstream’s Liquid Network Federation Reserves
- Independent corroboration
Independently corroborated by The Defiant
Liquid Sidechain Paused After 3,998 BTC Leaves Federation Wallet
- Update
Attackers post on-chain OP_RETURN message declaring themselves white hats
Message read "we are whitehats. contact us on chain," with 1,000 satoshis sent back to the federation wallet.
- Update
Liquid Network halts block production
Network fully halted block production amid the ongoing incident response.
- Resolution
Blockstream patches bridge nodes; attackers return 3,400 BTC
After confirmation that affected nodes were patched, 3,400 BTC (~$270 million) was sent back to the federation wallet, leaving ~598.5 BTC outstanding.
- Update
Blockstream continues negotiations for remaining 598.5 BTC
Liquid confirmed ongoing talks with the individuals responsible to recover the remaining ~$47 million.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 6 Sept 2026, 22:16 UTC: Bitcoin Magazine — 1 independent source, 1 reports
- 6 Sept 2026, 23:15 UTC: The Defiant — 2 independent sources, 2 reports
- 6 Sept 2026, 23:28 UTC: Cryptopolitan — 3 independent sources, 3 reports
- 8 Sept 2026, 07:33 UTC: CryptoPotato — 4 independent sources, 4 reports
- 8 Sept 2026, 08:00 UTC: BTC-ECHO — 5 independent sources, 5 reports
- 8 Sept 2026, 09:46 UTC: Unchained — 6 independent sources, 6 reports
- 8 Sept 2026, 17:58 UTC: Crypto.News — 7 independent sources, 7 reports
- 8 Sept 2026, 20:46 UTC: Decrypt — 8 independent sources, 8 reports
Affected entities
Also mentioned: Chainlink
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin Magazine Crypto media | Alleged White-Hat Hackers Withdraw 4,000 bitcoin from Blockstream’s Liquid Network Federation Reserves | Original | |
| Unchained Crypto media | Liquid Attackers Return 3,400 BTC and Keep Nearly 600 as Blockstream Prepares a Restart | Independent | |
| Decrypt Crypto media | $47M Still Missing After Liquid Hack as Blockstream Bargains With 'White Hats' | Independent | |
| The Defiant Crypto media | Liquid Sidechain Paused After 3,998 BTC Leaves Federation Wallet | Independent | |
| BTC-ECHO Crypto media | Erst verschwinden 4.000 Bitcoin – dann überweist der Hacker fast alles zurück | Independent | |
| Crypto.News Crypto media | Liquid Network drained of $320 million as cache bug lets attacker mint unbacked Bitcoin | Independent | |
| CryptoPotato Crypto media | Liquid Gets 3,400 BTC Back – but What About the 598 Bitcoin Still Missing? | Independent | |
| Cryptopolitan Crypto media | Liquid Network suffers a security breach with 4,000 BTC feared lost | Independent |
Related events
Binance Launches 24/7 USD/BRL Perpetual Futures With 100x Leverage
Binance is launching a 24/7 US dollar-Brazilian real perpetual futures contract on September 21, settling in USDT with up to 100x leverage.
Tether-backed Orionx to permanently close after audit reveals $7M custody shortfall
Chilean crypto exchange Orionx is shutting down after a forensic audit uncovered more than $7 million in customer assets moved to wallets outside its custody.
XRPPower Launches AI-Driven Earning Plans for XRP and BTC Holders with Up to $50,000 Advertised Returns
Crypto.News reported that XRPPower has introduced short- and long-term digital asset service plans for XRP, BTC, ETH, and USDT holders, with some plans advertising potential earnings up to $50,000.
