Liquid Network Retrieves 3,400 BTC After White Hat Exploit; 598.5 BTC Still Unreturned

Sept. 6, 2026 — Liquid Network suffered a major outflow from its federation wallet after a software vulnerability enabled a withdrawal that appeared, on-chain, to be an ordinary peg-out. About 4,000 BTC were drained via a SideSwap-processed pegout, an amount valued at roughly $320 million at the time. By the next day, 3,400 BTC had been returned to the federation address. Roughly 598.5 BTC — about $47 million — remains outstanding. Blockstream said the issue stemmed from Elements, the open-source codebase underlying Liquid and derived from Bitcoin Core. The vulnerability reportedly made it possible to create unbacked LBTC, effectively producing claims on Bitcoin without corresponding collateral. Blockstream emphasized that federation private keys were not compromised, and SideSwap's systems showed no evidence of intrusion. The transaction cleared standard authorization paths, which reduced the chance of detection in real time. The parties behind the drain later described themselves as white hat hackers, communicating through messages embedded in Bitcoin transactions using OP_RETURN alongside PGP-encrypted text. Blockstream said it patched affected bridge nodes on Sept. 7. After that announcement, the 3,400 BTC was returned. The remaining 598.5 BTC has not moved, with discussions described as ongoing. The partial return has sparked questions over whether the episode should be treated as a bug bounty-style recovery or something closer to coercion. Ledger CTO Charles Guillemet publicly pointed to the gap between the "white hat" label and the scale of funds still being held. Liquid remains paused. Exchanges supporting LBTC have been told to halt deposits and withdrawals, leaving LBTC holders unable to redeem to BTC and with no published timeline for reactivation. Liquid operates as a federated sidechain, relying on a consortium of functionaries rather than a decentralized validator set. BTC enters Liquid through a two-way peg to mint LBTC, and LBTC is redeemed for BTC via federation-authorized peg-outs. The Sept. 6 incident underscored that peg authorization can fail at the software layer even when cryptographic keys remain secure. Blockstream has not released technical details of the Elements vulnerability. While bridge nodes have been patched, the network has yet to resume operations.