Liquid Network hacked: 4,000 bitcoin gone, 3,400 returned

On Saturday 6 September, between 13:53 and 14:28 UTC, roughly 4,000 bitcoin left the federation wallet of Liquid Network, Blockstream's bitcoin sidechain. At that moment's price that was $319 million, about €274 million; according to TRM Labs the largest crypto hack of 2026 so far. A day later the attackers sent 3,400 BTC back. The remaining 598.5 BTC, about $47 million or €40 million, they still hold. Liquid has been halted since.

How the attack worked

Liquid is a sidechain: you send bitcoin to a wallet run by a federation of companies and receive L-BTC on the sidechain in return, one for one. The software that validates the sidechain is called Elements. That is where the flaw was: a bug in the range-proof cache let invalid transaction outputs pass as verified. With it, the attackers minted about 4,000 L-BTC with no bitcoin behind them.

They then offered that unbacked L-BTC for redemption through SideSwap, an approved peg-out operator. The federation runs an 11-of-15 multisig. It signed the payout, because Elements treated the chain containing the unbacked L-BTC as valid. In 36 minutes the federation wallet went from roughly 4,200 to just over 200 BTC. Blockstream says none of its keys were compromised, and SideSwap confirms the unbacked L-BTC came from a bug in Elements. This was not a stolen password but a flaw in the code the whole chain trusted.

White hats, with a reward of their own choosing

The attackers left a message on the chain: they are white hats, contact us on chain, and fix the bug first, because every node on the latest commit is at risk. On 7 September the return of 3,400 BTC followed, 85 percent of the haul.

Not everyone buys that story. Charles Guillemet, CTO of Ledger, compared it to the Ronin hack: taking the money first and negotiating afterwards is not responsible disclosure. Samson Mow, Blockstream's former CSO, noted that the contact request did not come from the address holding the bitcoin. And the 598.5 BTC kept back, 15 percent, is a reward the attackers granted themselves; Blockstream has offered no bounty of that size. TRM Labs has labelled the addresses and is tracking the $47 million.

What this means if you hold L-BTC

Three things are certain as of 9 September. The network is paused, exchanges have not resumed L-BTC trading, and redemption into bitcoin is halted. The federation has not announced recovery terms.

TRM Labs' arithmetic is the heart of it: about 3,597 BTC now sit in reserve against an estimated 4,200 L-BTC outstanding. That is roughly 86 percent backing. Until the 598.5 BTC comes back or Blockstream fills the gap itself, not every L-BTC is fully backed any more. Other assets on Liquid, such as USDT and tokenised securities, were not affected according to the first reports.

Anyone holding bitcoin on the main chain, in their own wallet or at an exchange, is untouched. The bug was in Elements, not in Bitcoin Core.

The market barely reacted

Bitcoin closed 8 September at $78,475, down 0.9 percent. The Motley Fool listed the hack among the reasons, alongside a more than 60 percent probability of a Fed rate hike per CME FedWatch and the continuing US–Iran strikes keeping oil above $100 a barrel. Over the month bitcoin is still up more than 20 percent.

What to take from it

A sidechain is an agreement: you hand your bitcoin to a federation and trust that their software and their signatures are sound. That is not the same as bitcoin in a wallet whose keys you hold. The downside of self-custody is that every mistake is yours; the downside of outsourcing is that someone else's bug becomes yours. Liquid has run since 2018, with Blockstream behind it and a fifteen-party multisig, and it was not enough once the validation code itself lied.

It fits the pattern we described in June: hacks are rarer but do more damage. After Coinsbuy in August and the hijacked accounts in DeFi, this is the third layer to fail: not the user, not the custodian, but the chain itself.

This is not advice to avoid L-BTC or Liquid, but it is a reason to decide, amount by amount, which risk you would rather carry: your own seed, or a federation.

Sources: TRM Labs, ‘2026's Biggest Hack To Date: Attackers Drained USD 319 Million in Bitcoin From Liquid Network’ (8 September 2026); Yahoo Finance, ‘Blockstream's Liquid Network Drained 4000 Bitcoin by Alleged White Hat Hackers’ (7 September 2026); The Motley Fool, ‘Crypto Market Today, Sept. 8’ (8 September 2026). Dollar amounts converted at the ECB reference rate of 8 September 2026 (€0.861 per dollar). Last checked: 9 September 2026.