Hackers Drain $320 Million From Liquid Network, Then Return Most of It
An attacker drained $320 million from Liquid Network's Bitcoin wallet, then returned most of it after the company fixed a security flaw. The attacker took nearly all the Bitcoin backing the network's tokens before returning most of the stolen funds.
- Report priority
- High
What is known
- The attacker exploited a flaw in Liquid Network's bridge nodes, which let them move Bitcoin out of the network's main wallet without permission.
- The attackers sent a request to the network's system that let them bypass normal security checks and take the Bitcoin.
- After the company fixed the flaw, the attackers returned most of the stolen Bitcoin but kept about $47 million for themselves.
What to do
If you use Liquid Network's L-BTC tokens or hold Bitcoin in a wallet connected to it, check if your Bitcoin or L-BTC holdings are tied to Liquid Network and monitor for unusual activity in your accounts. The hack only impacted the network's main wallet and bridge nodes, not individual user accounts.
Liquid Network has already fixed the security flaw in its bridge nodes. If you use Liquid Network, check your Bitcoin or L-BTC holdings for any unusual transactions. The company has returned most of the stolen Bitcoin, but about $47 million remains missing. For further updates, follow official announcements from Liquid Network or Blockstream.
Claim from the attackers
Crypto exchange network Liquid Network lost $320 million overnight, then got most of it back after the hackers demanded a bug fix instead of a ransom Bitcoin’s Liquid Network, a sidechain built by Blockstream and used by dozens of exchanges to move funds faster and more privately than the main Bitcoin blockchain allows, got drained of roughly 4,000 of the 4,200 Bitcoin sitting in its federation wallet on September 6. The attackers, who described themselves as white-hat hackers, have since returned 3,400 of those crypto coins, worth around $262.6 million, while keeping roughly 598 BTC, close to $47 million, for themselves. Update: 3,400 BTC of the roughly 4,000 BTC withdrawn on September 6 has been returned to the @Liquid_BTC Federation wallet.
The return followed confirmation from @Blockstream that the affected bridge nodes have been patched. Approximately 598 BTC remains outstanding, and… — Samson Mow (@Excellion) September 7, 2026 The size of the initial theft makes this much more serious than another crypto hack. The attacker took nearly 95% of the wallet’s Bitcoin in a single transaction, leaving the fund behind Liquid’s L-BTC token with only about 197 BTC.
This wasn’t a partial breach. The attacker drained almost the entire collateral pool that should back every L-BTC token with an equal amount of real Bitcoin. How the money actually left is the more technically interesting part. According to Bitrue’s breakdown of the exploit, the attackers didn’t steal a private key or compromise any authorization credentials at all.
A software bug in Elements, the open-source code powering Liquid Network, apparently let more L-BTC exist than the system’s real Bitcoin reserves should have allowed, and that unbacked token was then redeemed for genuine BTC through SideSwap’s authorized peg-out mechanism. Liquid itself confirmed the specific access point directly, stating plainly that the funds moved through SideSwap’s authorization key, and that key itself was never compromised. What happened next is where this stops looking like an ordinary crypto heist.
Rather than demanding a ransom payment or threatening to dump the stolen coins, the attackers negotiated entirely in public, writing messages directly into Bitcoin transactions using the OP_RETURN field, a way to embed small amounts of arbitrary data on-chain.
Reported details
The attacker sent a request to Liquid Network's bridge nodes that let them move 4,000 Bitcoin out of the network's main wallet in one transaction. This drained nearly all the Bitcoin backing the network's tokens, leaving only about 197 Bitcoin in the wallet.