Liquid Network Hackers Return 3,400 Bitcoin but Retain $47 Million as 'White-Hat' Bounty

A self-described "white-hat" hacking group insists it drained 4,000 Bitcoin—worth $320 million—from the Liquid Network to force a critical security patch, returning 3,400 BTC once the vulnerability was closed. Cybersecurity analysts and network operators, however, point to the 598.5 Bitcoin that the attackers retained as a self-declared $47 million bounty, arguing that a 15% withholding crosses the line from responsible disclosure into extortion. The debate centers on whether the return of the majority of the funds justifies the retention of a massive payout, setting a complex precedent for how decentralized networks handle catastrophic exploits.[2][3][5]

The September 6, 2026, breach removed 95% of the sidechain's total Bitcoin reserves in a single transaction, leaving the federation wallet with a fraction of its former holdings. For institutional traders and retail users holding L-BTC—a token designed to be backed one-to-one by Bitcoin on the base layer—the drain temporarily reduced the backing of their assets to pennies on the dollar. This severe undercollateralization forced major cryptocurrency exchanges to immediately freeze L-BTC deposits and withdrawals, while the network operators paused all sidechain operations to prevent any further hemorrhaging of funds and to assess the scope of the vulnerability.[3][5]

The unauthorized withdrawal did not rely on stolen private keys or a conventional phishing attack. Instead, the attackers exploited a cache-key collision vulnerability in Elements, the open-source software underlying the Liquid Network. This flaw allowed them to mint 4,000 unbacked L-BTC out of thin air and process it through SideSwap's Peg-out Authorization Key (PAK). Because the transaction appeared valid under the buggy consensus rules, it tricked the federation's 11-of-15 multisignature wallet into releasing real Bitcoin to an external address without compromising the keys themselves.[2][3][4][5]

Immediately following the withdrawal, the attackers embedded a message in the Bitcoin blockchain's OP_RETURN field, stating clearly, "we are whitehats. contact us on chain." Blockstream, the primary developer behind the Liquid Network, responded via PGP-encrypted messages, initiating a highly public negotiation visible on the distributed ledger. The attackers demanded that every bridge node be patched against the Elements software bug before any funds would be returned, effectively framing the $320 million theft as a forced security audit rather than a malicious heist. This unconventional communication method underscored the transparency of blockchain networks even during active security crises.[1][5][6]

On September 7, 2026, after Blockstream confirmed the deployment of updated software to close the vulnerability, the attackers initiated a transaction at 16:09 UTC. They sent 3,400 BTC back to the Liquid Federation's wallet, restoring 85% of the stolen reserves. The remaining 598.5 BTC was routed to a change address controlled by the attackers, where it currently sits unmoved. Neither Blockstream nor the Liquid Network has publicly confirmed whether this retained amount represents an agreed-upon settlement or an ongoing dispute.[5][6]

The Liquid Network remains paused as federation members coordinate a safe restart and work to resolve a resulting chain split caused by the emergency halt. While the return of the 3,400 BTC averts a total collapse of the sidechain's peg, the missing $47 million leaves a significant hole in the reserve that must be addressed before normal operations can resume. Blockstream continues to communicate with the attackers, navigating the delicate balance between recovering the remaining funds and restoring operational normalcy for users whose assets remain frozen on the sidechain during the ongoing outage.[2][3][6]

The incident strictly isolates the risk to the sidechain infrastructure; the Bitcoin base layer and its underlying consensus rules were entirely unaffected by the exploit. However, the breach vividly highlights the distinct counterparty risks inherent in federated networks. Users of these sidechains rely on a consortium of operators and complex bridge software rather than the decentralized security of the main blockchain. This architecture exposes them to software bugs that can drain reserves even when cryptographic keys remain perfectly secure, challenging the assumption that sidechains inherit the full security profile of the base layer.[3][4][5]

As cryptocurrency exchanges wait for the official all-clear to resume L-BTC trading, the immediate focus shifts to how the Liquid Federation will recapitalize the missing 598.5 Bitcoin. The network must now demonstrate whether it can absorb a $47 million shortfall without permanently impairing the one-to-one peg that underpins its core utility. Until the reserves are fully restored or the attackers voluntarily return the balance, the sidechain effectively operates with a fractional backing, testing the broader market's tolerance for federated security models in high-value digital asset infrastructure.[2][6]