On September 6, 2026, Liquid Network announced the withdrawal of nearly 4,000 $BTC (approximately $320 million) from the Liquid Federation wallet—an operation carried out by alleged "white hackers." On social network X, the team reported that Blockstream is attempting to contact the perpetrators via a signed message in the blockchain.
Liquid Network is an additional network on top of Bitcoin (a sidechain) developed by Blockstream. It was created to bypass the limitations of ordinary Bitcoin: blocks in the main network are confirmed on average every 10 minutes, and the amounts of all transactions are visible to anyone. In Liquid, blocks are formed approximately once a minute, which is convenient for exchanges and trading, while transfer amounts are hidden from prying eyes. To use the network, regular bitcoins are locked in a special vault—Liquid Federation—and in return, L-$BTC tokens are issued, which replace bitcoin in the sidechain on a one-to-one basis. When it is necessary to return real bitcoins, L-$BTC is destroyed, and an equivalent amount of $BTC is paid out from the vault. This process is called peg-out.
It was precisely this exchange that was used for the theft. The key that authorizes the exchange of L-$BTC for bitcoins (Peg-out Authorization Key) was not compromised—nor were other federation keys. Exchanges were notified of the incident, and they have suspended (or are preparing to suspend) LBTC deposits and withdrawals. Other assets on Liquid were not affected by the attack:
- USDT
- DePix
- tokenized real assets (RWA)
The bridge nodes were temporarily disabled, effectively halting the sidechain's operation.
How it Happened
The company SideSwap, which helps users exchange L-$BTC back to bitcoins, reported on social network X that on September 6 at 14:05 UTC, a client sent it 4,000 L-$BTC for exchange. The request was processed as usual: L-$BTC was destroyed with a formally valid authorization, and at 14:28 UTC, the Liquid Federation paid out 3,996 $BTC to the client's bitcoin address.
Later, Blockstream discovered that these L-$BTC were artificially created—through a vulnerability in the Elements software that powers Liquid. In other words, the attackers did not steal someone else's tokens but managed to "mint" new L-$BTC bypassing the system. Neither SideSwap's keys nor its internal systems were hacked: the service simply could not distinguish counterfeit L-$BTC from genuine ones. SideSwap user wallets were not affected, as the service does not store client funds.
Negotiations via Blockchain
According to on-chain analytics, the stolen funds were sent to address bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte. In the subsequent transaction, the attackers left a message in the blockchain: "we are whitehats. contact us on chain." Blockstream responded in the same manner, asking them to write to security@blockstream.com.
The parties continued their correspondence directly in the blockchain and via PGP signatures (a method to verify the sender's authenticity). The attackers stated they are ready to return a "large portion" of the withdrawn funds after the vulnerability in Elements is fixed.
Prior to the incident, the federation reserves were approximately 4,200 $BTC; after the withdrawal, about 197 $BTC remained in the wallet. Current reserve data can be tracked via liquid.network.
The incident only affected the Liquid sidechain and its mechanism for exchanging L-$BTC for bitcoins, whereas the main Bitcoin network was not impacted. Blockstream continues negotiations with the attackers and work on fixing the vulnerability in Elements.
AI Opinion
From a technical analysis perspective, the Liquid Network incident repeats a pattern familiar from the history of cross-chain bridges: the attacker targets not the storage keys but the logic of the wrapped token's emission. A similar scenario was implemented in 2022 on the Wormhole bridge, where an attacker was able to generate 120,000 Wrapped ETH without real backing. A noticeable difference between the cases: the stolen funds were not returned then, whereas the attackers are currently negotiating and promising to return a "large portion" of the sum.
The synthetic nature of L-$BTC creates a risk rarely discussed publicly: the token's price in the sidechain is maintained not by exchange demand but by trust in the bridge's code, so a bug in emission can remain undetected for a long time until peg-out. The model with a federation of trusted participants reduces the risk of key compromise but does not eliminate vulnerabilities in the software itself. Will the attackers' goodwill remain the only guarantee of fund recovery, or will the industry develop a more reliable mechanism for emergency revocation of compromised tokens?
