Liquid Network hackers return 3,400 BTC of ~4,000 BTC heist, still hold ~598 BTC ($47M)

Attackers exploited a bug in Elements software to withdraw ~4,000 BTC (~$320M, roughly 95% of reserves) from Blockstream's Liquid Network federation wallet on September 6, 2026, then returned 3,400 BTC after the bug was patched; ~598 BTC (~$47M) remain…

On September 6, 2026, attackers exploited a bug in Elements, the open-source software powering Blockstream's Liquid Network Bitcoin sidechain (launched 2018), to mint unbacked L-BTC and withdraw roughly 4,000 of the federation wallet's ~4,200 BTC in a single transaction — about 95% of reported reserves. Sources value the haul at ~$320 million (DataBreaches.net, The Hacker News, SecurityWeek, Security Affairs); TechCrunch reports ~$340 million. Funds were moved through SideSwap's Peg-out Authorization Key, which Blockstream says — along with other keys — was not compromised. Blockstream disclosed the heist on Sunday, September 6, disabled nodes, and paused network operations. Self-described 'white hat' hackers, negotiating via on-chain OP_RETURN and PGP-encrypted messages, demanded bridge nodes be patched before returning funds; on Monday, September 7, they returned 3,400 BTC (valued between ~$262.6M and ~$293M depending on source and BTC price), retaining ~598.5 BTC (~$47M) pending further security improvements. Former Blockstream executive Samson Mow confirmed the bug was fixed and the funds returned. Blockstream says affected nodes are patched, but the network remains paused pending a coordinated restart, and users are warned against peg-ins. Rekt ranks the heist among the largest cryptocurrency thefts to date, and experts — including Ledger CTO Charles Guillemet, who called the arrangement extortion — debate whether the act legally constitutes extortion.

• ~4,000 BTC withdrawn from the Liquid Network federation wallet on September 6, 2026; wallet held ~4,200 BTC, so roughly 95% of reserves was drained in one transaction
• Stolen amount valued at ~$320M by most sources; TechCrunch reports ~$340M
• Attack vector: bug in Elements, the open-source software behind Liquid, enabling unbacked L-BTC creation; funds redeemed via SideSwap's Peg-out Authorization Key, which Blockstream says was not compromised
• 3,400 BTC returned to the federation address on September 7, 2026; valued ~$262.6M (SecurityWeek, Security Affairs), ~$265M at ~$78,000/BTC (The Hacker News), or ~$293M (TechCrunch)
• ~598.5 BTC (~$47M) remains under the hackers' control pending further security improvements
• Attackers called themselves white hats, demanded bridge node patches before returning funds, and negotiated via on-chain OP_RETURN and PGP-encrypted messages
• Former Blockstream executive Samson Mow confirmed the bug was fixed and ~3,400 BTC returned
• Ledger CTO Charles Guillemet characterized the arrangement as extortion; experts debate the legal characterization