Pull to refresh
Logo
What Changed
Following Why Sign Up
Liquid Network drained of 4,000 BTC in Elements bug exploit

Liquid Network drained of 4,000 BTC in Elements bug exploit

Money Moves

Purported white-hat hackers still hold nearly 4,000 BTC and say they'll return it once the bug is patched on every node.

September 6th, 2026: SideSwap processes 4,000 L-BTC peg-out

Overview

Updated Sep 8

Liquid, a Bitcoin sidechain run by Blockstream, lost nearly all its bitcoin reserves on September 6. A single peg-out transaction moved about 4,000 BTC, worth roughly $320 million, to the Bitcoin mainchain, leaving about 200 of the wallet's prior 4,200 BTC. The withdrawal exploited a validation bug in Elements, the open-source software that powers Liquid.

The bug let someone create L-BTC with no real Bitcoin behind it, then redeem it through a legitimate-looking peg-out. Liquid paused its bridge nodes and says no federation key was compromised. The party behind the withdrawal calls itself white-hat hackers and says it will return most funds once the bug is patched on every node.

Why it matters

If the bitcoin isn't returned, L-BTC holders are stuck with tokens backed by a wallet that's 95% empty.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

~4,000 BTC
Bitcoin withdrawn from the federation wallet
Worth roughly $320 million at the time of withdrawal.
95%
Share of federation reserves withdrawn
The wallet dropped from about 4,200 BTC to roughly 200 BTC.
5 weeks
How long the Elements fix was available before the exploit
Blockstream added the fix five weeks before the withdrawal, but not all nodes were patched.
4,050,336
Liquid block with the exploit transaction
The exploit transaction created about 3,996 L-BTC with no Bitcoin backing, per analyses reported by CryptoRank. The flaw appears to sit in range proofs, the mechanism nodes use to verify hidden transaction amounts.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

UH
Unidentified white-hat hackers
Party behind the withdrawal
Holding ~3,998.5 BTC, negotiating return with Blockstream
 Adam Back
Adam Back
Chief executive of Blockstream
Leading the company's response
 Samson Mow
Samson Mow
Former Blockstream chief security officer, now CEO of Jan3
Commenting publicly on the incident

Organizations Involved

Blockstream
Blockstream
Software company
Paused Liquid's bridge nodes, coordinating patch rollout and fund recovery

Developer of Liquid, a Bitcoin sidechain, and Elements, the open-source software that powers it.
Liquid Network
Liquid Network
Bitcoin sidechain
Paused since September 6, 2026

A Bitcoin sidechain secured by a 15-member federation, used for faster and more confidential Bitcoin transfers.
SideSwap
SideSwap
Bridge exchange
Suspended operations during investigation

A Liquid Federation member and bridge exchange that processed the peg-out used in the exploit.
Liquid Federation
Liquid Federation
Consortium
Investigating the incident; working to patch the Elements flaw and reconcile the reserve

The 15 companies that jointly control and secure the Liquid Network.

Timeline

7 events Latest: September 6th, 2026 · 2 months ago
Tap a bar to jump to that date

  1. SideSwap processes 4,000 L-BTC peg-out

    Latest Security Incident

    A customer's 4,000 L-BTC is burned under a valid authorization at SideSwap's bridge service.

  2. Block 965,783 settles 3,996 BTC payout

    Security Incident

    The federation releases 3,996 BTC from the reserve wallet in one 83-input transaction.

  3. Liquid disables bridge nodes, alerts exchanges

    Statement

    Liquid announces the withdrawal, pauses bridge nodes, and asks exchanges to suspend L-BTC.

  4. Hackers identify themselves on-chain

    Communication

    The destination address broadcasts 'we are whitehats. contact us on chain' via OP_RETURN.

  5. Blockstream responds, negotiations go on-chain

    Communication

    Blockstream shares its security team's email; PGP-signed messages are exchanged in Bitcoin transactions.

  6. Hackers set return conditions

    Communication

    Hackers say they'll send back most funds after the Elements bug is fixed on every node.

  7. Blockstream replies 'Yes, thank you'

    Communication

    Blockstream answers the hackers' offer to return most coins to a Blockstream address. Mow says the reply answered the return-address question, not the patching condition. About 3,998.5 BTC remained at the hackers' address.

Scenarios

1

White-hats return funds after the patch

Likely Resolves by End of 2026

Discussed by: Decrypt, The Register, and the on-chain negotiation itself

The hackers have already signaled willingness to return most funds, conditioned on Blockstream patching the Elements bug on all nodes. Blockstream replied 'Yes, thank you.' If the patch is confirmed and the bitcoin transfers back, the federation wallet is largely restored and L-BTC redemption continues at 1:1.

2

Partial return, L-BTC holders absorb losses

Possible Resolves by Q1 2027

Discussed by: Cryptoticker and market commentary on the peg discount

The hackers return only some of the coins, or the return drags out. Peg-outs stay paused and the federation wallet remains far short of what it held. L-BTC holders face redemptions below 1:1, and the token trades at a discount on secondary markets when trading resumes.

3

No return, criminal investigation opened

Unlikely Resolves by Q2 2027

Discussed by: Unlikely but possible; large illicit transfers typically draw law enforcement

Negotiations break down or the hackers never intended to return the funds. The Liquid federation pursues legal action, and US or other law enforcement opens an investigation into the transfer. A recovery would need the kind of coordinated action that unraveled the Ronin bridge case.

4

Liquid Peg Stays Paused After White-Hats Return Bitcoin

Deadline passed (Q3 2026)

Discussed by: CryptoSlate's analysis of the federation's remaining work

The white-hats transfer the bitcoin back after the patch. The federation then must reconcile the reserve and prove another batch of invalid L-BTC cannot pass through the same authorization process before peg-outs reopen.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

June 2016

The DAO hack (2016)

An attacker drained about $60 million from The DAO, a smart contract on Ethereum, using a reentrancy bug. The attacker argued the code permitted the withdrawal, calling it a legitimate exercise of the contract's rules.

Then

The Ethereum community hard-forked the blockchain to reverse the theft, splitting the network into Ethereum and Ethereum Classic.

Now

The incident set a precedent that code exploits could be reversed through community consensus, and it framed the debate around whether an exploit that follows the code's letter is theft.

Why this matters now

Like the DAO, this Liquid exploit used a legitimate-looking transaction that exploited a code bug. The white-hat justification echoes the DAO attacker's argument, though this party is offering to return the funds.

March 2022

Ronin Bridge hack (2022)

Attackers stole $625 million from the Ronin bridge, which moved funds between the Axie Infinity game and Ethereum. Compromised private keys, not a code bug, allowed the drain, making it the largest DeFi hack at the time.

Then

US law enforcement recovered about $30 million and later indicted two individuals. The Securities and Exchange Commission charged the parent company, Sky Mavis.

Now

The case showed both the vulnerability of bridges and sidechains and the reach of law enforcement in recovering stolen crypto.

Why this matters now

Ronin was a sidechain bridge exploit on a massive scale, like Liquid. Its recovery came through law enforcement action rather than negotiation, offering a contrasting path to resolution.

February 2022

Wormhole bridge hack (2022)

A hacker drained $320 million, roughly the same amount as this Liquid incident, from the Wormhole bridge using a signature validation bug. Jump Crypto, which backed the project, replaced the funds within hours.

Then

Wormhole users were made whole. The attacker remained unidentified but later returned $155 million.

Now

The incident showed that a financial backer could absorb losses to protect user confidence, and that crooks sometimes return a portion of stolen funds.

Why this matters now

Wormhole's $320 million loss matches this exploit almost exactly. It illustrates the scale of bridge and sidechain hacks and one path to resolution: a deep-pocketed backer covering the loss.

Sources

(13)
+7
Liquid Network on X Decrypt The Register Bitcoin Magazine ETHNews Block Stream Media Cryptoticker CryptoBriefing Cointelegraph CryptoSlate CryptoRank Protos Bitcoin.com News