Actors who drained 4,000 bitcoin from the Liquid Network returned 3,400 of it the next day, leaving about 598.5 BTC, worth roughly $47 million, still under their control. The sidechain remains paused, so holders cannot convert the L-BTC token back into bitcoin while federation members work on a fix.The withdrawal happened on Sunday, September 6, through SideSwap’s Peg-out Authorization Key, one of the keys that releases funds from the sidechain to the main bitcoin blockchain. Blockstream, the company that provides Liquid’s technology, said that key was not compromised, and neither were any others. The problem sat one layer down: a bug in Elements, the open-source software Liquid runs on, created L-BTC that had no corresponding bitcoin in the federation wallet. SideSwap confirmed the L-BTC used in the peg-out came from the Elements bug rather than its own systems, and said its infrastructure and key were untouched.
Negotiating on the blockchain
The withdrawal took about 95% of the federation wallet’s balance, which stood near 4,200 BTC before the incident. Blockstream valued the haul at around $320 million at the time of the attack.What followed was unusual even by crypto standards. The two sides negotiated in public, on the bitcoin blockchain itself. An early message written into a transaction read “we are whitehats.” Blockstream answered through signed onchain messages, and the actors replied with encrypted technical details of the vulnerability, according to Galaxy Digital research head Alex Thorn. The actors told Blockstream they would return most of the bitcoin once the Elements vulnerability was patched across every node in the federation.On September 7 at 16:09 UTC, 3,400 BTC, roughly 85% of the total, arrived at a Liquid Federation address. At bitcoin’s price near $78,000 on September 8, that amount was worth about $265 million. The remaining 598.5 BTC was not a separate payment. It is the change from that same return transaction, sent back to the address the funds had come from, and it was still sitting there on September 8, according to block explorer mempool.space.
| Item | Amount | Status |
|---|---|---|
| Withdrawn from federation wallet | 4,000 BTC | Sept 6, via Elements bug |
| Returned to federation | 3,400 BTC | Sept 7, roughly $265 million |
| Still held by actors | 598.5 BTC | About $47 million |
| Wallet balance before incident | ~4,200 BTC | About 95% taken |
White hat or extortion
Neither Blockstream nor Liquid has said publicly whether the retained bitcoin is part of an agreed bounty, and Blockstream’s incident page does not describe the flaw. Security researcher Charles Guillemet, CTO at Ledger, noted that letting the actors keep roughly 600 BTC as a reward would hardly qualify as a typical white-hat operation and would look closer to extortion. The distinction matters because a genuine white-hat rescue usually ends with full recovery plus a modest, negotiated payout, not a tenth of the haul held indefinitely.Liquid issued other assets on the network, including tether, DePix and tokenized real-world assets, and said those were unaffected by the bug. Exchanges halted or prepared to halt L-BTC deposits and withdrawals, and bridge nodes were disabled to prevent new transactions. Federation members were still working to patch the vulnerability with no restart date announced as of September 8.
A rough month for crypto security
The episode lands in a bruising stretch for crypto custody. DeFi protocols have lost at least $1.3 billion to exploits through the first eight months of 2026, according to CertiK data reported by Forbes, and a September analysis found compromised keys and wallet infrastructure overtook smart contract bugs as the costliest attack vector for the first time since tracking firms began publishing annual breakdowns. North Korea’s Lazarus Group has been tied to at least $575 million of this year’s DeFi losses.Liquid’s case fits a third category. The software that mints and burns the bridged asset failed, and the federation’s governance was left to bargain with whoever found the flaw first. The network’s design places a small group of functionaries in charge of the bitcoin backing L-BTC, which concentrates risk in exactly the way its critics describe, even though the federation itself was not breached through its keys.For now, the market is watching two things: whether Blockstream patches Elements across all federation nodes and reopens the bridge, and whether the remaining $47 million ever comes back. If it does not, the “white hat” framing will get harder to defend, and Liquid will have paid a nine-figure lesson in the cost of a single bug in shared infrastructure.
discussion