The Liquid Community recovered 3,400 BTC on September 7, at some point after roughly 4,000 BTC, then valued at $320 million, was drained from the Liquid Federation pockets on the Bitcoin blockchain. The returned quantity accounts for about 85% of the transferred Bitcoin, however practically 598.5 BTC stays at an handle managed by the entity that executed the transaction.
Recovering nearly all of the Bitcoin considerably reduces the shortfall within the federation’s reserves, nevertheless it doesn’t totally resolve the incident. Liquid has not but confirmed when operations will resume or launched a technical postmortem explaining the basis trigger, leaving unanswered questions concerning the lacking funds and the safety controls defending the Bitcoin backing L-BTC.
We’re conscious of a safety incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation pockets. The @Blockstream group is engaged on contacting them on-chain with a signed message.
What we all know to this point is that the funds…
— Liquid Community 🌊 (@Liquid_BTC) September 6, 2026
3,400 BTC Returned, 598.5 Excellent
The incident started on September 6 when an unknown get together drained roughly 4,000 BTC from the Liquid Federation pockets representing practically 95% of its pre-incident stability of round 4,200 BTC. Liquid valued the transferred belongings at roughly $320 million and described the occasion as a safety incident. The actor later claimed to be a white-hat hacker.
A day later, the return transaction was confirmed at Bitcoin block 965,950 at round 16:09 UTC. On-chain knowledge exhibits that precisely 3,400 BTC was transferred again to the federation handle, whereas roughly 598.4996 BTC returned to an handle managed by the entity behind the withdrawal.
With Bitcoin buying and selling close to $79,000 on the time, the returned portion was value roughly $268 million, representing 85% of the drained BTC. The remaining quantity is valued at roughly $47 million. The handle disclosed by Liquid at the moment holds round 3,597.47 BTC, in comparison with roughly 197 BTC instantly following the incident.
Liquid and Blockstream haven’t indicated whether or not the remaining Bitcoin might be returned. Neither get together has confirmed whether or not the unreturned funds characterize a bug bounty, an agreed-upon charge, or belongings retained unilaterally by the actor.
The SideSwap Peg-Out
Liquid is a sidechain designed to facilitate worth transfers between its community and the Bitcoin blockchain. BTC is locked within the federation pockets to mint L-BTC on Liquid at a 1:1 ratio. Conversely, the peg-out course of burns L-BTC earlier than the federation releases a corresponding quantity of BTC to the recipient.
Direct peg-out transactions require a Peg-out Authorization Key (PAK) to confirm that the vacation spot Bitcoin handle is permitted. Customers with no devoted PAK can execute withdrawals via third-party service suppliers similar to SideSwap.
Within the transaction concerned within the incident, 4,000 L-BTC was submitted to SideSwap’s peg-out service at 14:05 UTC. These tokens have been burned utilizing a legitimate authorization. Roughly 23 minutes later, the Liquid Federation transferred 3,996 BTC to the client’s Bitcoin handle.
SideSwap said that the L-BTC used within the withdrawal stemmed from a bug within the underlying Parts software program relatively than points inside its personal platform. The PAK used to course of the transaction was not compromised, and the tokens couldn’t be distinguished from normal L-BTC on the time of execution. Blockstream has not but revealed its personal technical report totally explaining the vulnerability.
Assertion on right this moment’s Liquid incident
Right this moment at 14:05 UTC a buyer despatched 4,000 L-BTC to the SideSwap peg-out service. Our service processed it like some other order: the L-BTC was burned on Liquid with a legitimate peg-out authorisation, and at 14:28 UTC the Liquid Federation paid…
— SideSwap (@side_swap) September 6, 2026
Negotiations Transfer On-Chain
Following the drain, the entity controlling the recipient BTC handle embedded the message “we’re whitehats. contact us on chain” into the OP_RETURN discipline of a Bitcoin transaction. Blockstream responded with a 1,000-satoshi transaction containing its safety group’s e-mail handle, initiating a communication chain publicly recorded on the blockchain.
Subsequent messages utilized digital signatures and PGP encryption to authenticate senders and alternate confidential particulars. In a message at block 965,875, the actor requested that Blockstream repair the vulnerability and replace its nodes previous to the return of the belongings.
Blockstream later despatched a signed message confirming that the bridge nodes had been patched and that Bitcoin might safely be transferred again. The transaction returning 3,400 BTC to the federation handle was confirmed at block 965,950 following this announcement.
Liquid Prepares to Restart
Upon detecting the incident, Liquid disabled its bridge nodes, stopping new transactions from being submitted to the community. Exchanges have been instructed to droop L-BTC deposits and withdrawals. SideSwap additionally halted swaps, peg-ins, and peg-outs pending Liquid’s operational resumption.
Liquid said that different issued belongings, together with USDT, DePix, and tokenized real-world belongings, weren’t immediately impacted by the incident. Nonetheless, the suspension of community processing continues to briefly disrupt switch capabilities for these belongings. SideSwap famous that funds held in non-custodial wallets stay underneath consumer management and that accomplished peg-outs on the Bitcoin blockchain can’t be reversed.
On September 8, Blockstream, Liquid’s major know-how supplier, said that up to date software program had been deployed and that federation members have been making ready a coordinated community restart.
As of September 9, Liquid has but to verify that community exercise has totally resumed. Blockstream’s public explorer continues to show the most recent Liquid block at top 4,051,232, with a timestamp of 04:49 UTC on September 7. Consequently, L-BTC buying and selling, deposit, and withdrawal providers ought to nonetheless be described as suspended till official affirmation is offered.
Liquid Community explorer. Supply: Blockstream
No Postmortem But
SideSwap famous that Blockstream recognized the L-BTC within the peg-out request as having been generated by way of a bug in Parts, Liquid’s underlying software program framework. Nonetheless, neither Blockstream nor Liquid has launched a technical report explaining how the bug was exploited or why the minting of the affected L-BTC was validated as reputable asset knowledge by the community.
Public info has additionally not but recognized the particular Parts software program model affected, the complete scope of the vulnerability, or the validation checks that failed to dam the transaction. Blockstream has solely confirmed the deployment of up to date software program with out disclosing particulars of the patch or further safeguards added to the peg-out pipeline.
As of September 9, no post-incident reconciliation has been revealed evaluating complete circulating L-BTC in opposition to the BTC held by the federation. This reconciliation is important to confirm the 1:1 backing standing of L-BTC after the return of nearly all of the Bitcoin, whereas a portion stays outdoors the federation pockets.
