Liquid Network Halts Operations After 4,000 BTC Withdrawal by Purported White-Hat Hackers
Here's what it means for you.
If you engage with Bitcoin or its sidechains, this incident highlights the importance of security protocols and the potential for rapid changes in liquidity.
Why it matters
This incident underscores vulnerabilities in blockchain technology that can impact liquidity and trust in decentralized finance.
What happened (in 30 seconds)
- On September 6, 2026, the Liquid Network halted operations after 4,000 BTC (~$320 million) were withdrawn by purported white-hat hackers.
- The exploit involved a flaw in the Elements software that allowed the minting of unbacked L-BTC, which was then pegged out without compromising federation keys.
- Negotiations led to the return of approximately 3,400 BTC, while the hackers retained about 598 BTC as a bounty for identifying the vulnerability.
The context you actually need
- Liquid Network was launched in 2018 to enhance Bitcoin liquidity and transaction speed through a two-way peg mechanism for L-BTC.
- Blockstream, the operator, relies on a federation model and open-source software, making it susceptible to vulnerabilities that can be exploited.
- The incident primarily affected L-BTC operations, leaving other assets and the Bitcoin mainnet unaffected, but raised questions about security practices in the crypto space.
What's really happening
On September 6, 2026, at approximately 14:05 UTC, a group of actors withdrew 4,000 L-BTC from the Liquid Federation wallet using SideSwap's peg-out service. This triggered a federation payout of nearly 4,000 BTC to a Bitcoin address controlled by the actors. They identified themselves as white-hat hackers, indicating their intention to help rather than harm. Their message on-chain stated, "we are whitehats. contact us on chain," prompting Blockstream to engage in negotiations.
The exploit stemmed from a vulnerability in the Elements software, which allowed the minting of unbacked L-BTC. This flaw was significant enough to warrant immediate action, leading to the temporary suspension of the network to prevent further exploitation. The actors demanded a patch for the Elements bug before returning the funds, highlighting a unique intersection of ethical hacking and blockchain security.
By September 7-8, approximately 3,400 BTC were returned, while the hackers retained about 598 BTC (~$47 million) as a bounty. This incident has raised critical discussions about the ethics of white-hat hacking in the cryptocurrency space and the responsibilities of developers to secure their platforms.
In the aftermath, exchanges suspended L-BTC deposits and withdrawals, and the Liquid Network remained paused as of September 8, 2026. Blockstream and federation members are now focused on deploying patches and resolving any chain splits to prepare for a restart. The partial recovery of funds has mitigated immediate collateral concerns, but the incident has sparked public debate regarding the source of the vulnerability and the practices of white-hat hackers.
Despite the turmoil, Bitcoin's price showed minimal movement, indicating that the broader market may not yet fully grasp the implications of such vulnerabilities. However, the incident serves as a reminder of the fragility of trust in decentralized finance and the need for robust security measures.
Who feels it first (and how)
- Crypto exchanges: Immediate suspension of L-BTC operations affects trading volumes and liquidity.
- Investors in L-BTC: Those holding L-BTC face uncertainty regarding the asset's future and liquidity.
- Developers and security teams: Increased scrutiny on security practices and the need for rapid response protocols.
- Regulators: Heightened interest in the security of blockchain technologies may lead to more stringent oversight.
What to watch next
- Network recovery timeline: How quickly Blockstream can resolve the issues and restart operations will impact market confidence.
- Security audits: Increased focus on security audits for blockchain platforms could lead to new standards in the industry.
- Market reactions: Watch for any shifts in Bitcoin's price or trading volumes as the implications of this incident unfold.
The Liquid Network paused operations due to a security incident involving white-hat hackers.
Increased scrutiny on blockchain security practices and potential regulatory responses.
The long-term impact on the reputation of Liquid Network and its ability to regain user trust.
Frequently Asked Questions
- Why it matters?
- This incident underscores vulnerabilities in blockchain technology that can impact liquidity and trust in decentralized finance.
- What happened (in 30 seconds)?
- On September 6, 2026, the Liquid Network halted operations after 4,000 BTC (~$320 million) were withdrawn by purported white-hat hackers. The exploit involved a flaw in the Elements software that allowed the minting of unbacked L-BTC, which was then pegged out without compromising federation keys. Negotiations led to the return of approximately 3,400 BTC, while the hackers retained about 598 BTC as a bounty for identifying the vulnerability.
- What's really happening?
- On September 6, 2026, at approximately 14:05 UTC, a group of actors withdrew 4,000 L-BTC from the Liquid Federation wallet using SideSwap's peg-out service. This triggered a federation payout of nearly 4,000 BTC to a Bitcoin address controlled by the actors. They identified themselves as white-hat hackers, indicating their intention to help rather than harm. Their message on-chain stated, "we are whitehats. contact us on chain," prompting Blockstream to engage in negotiations. The exploit stemm
- Who feels it first (and how)?
- Crypto exchanges: Immediate suspension of L-BTC operations affects trading volumes and liquidity. Investors in L-BTC: Those holding L-BTC face uncertainty regarding the asset's future and liquidity. Developers and security teams: Increased scrutiny on security practices and the need for rapid response protocols. Regulators: Heightened interest in the security of blockchain technologies may lead to more stringent oversight.
- What to watch next?
- Network recovery timeline: How quickly Blockstream can resolve the issues and restart operations will impact market confidence. Security audits: Increased focus on security audits for blockchain platforms could lead to new standards in the industry. Market reactions: Watch for any shifts in Bitcoin's price or trading volumes as the implications of this incident unfold.
Real-time updates, analysis, and reports on the blockchain and cryptocurrency sectors.
"Crypto News delivers real-time updates, analysis, and reports on the blockchain and cryptocurrency sectors."
— A47 Editor
Liquid Network drained of $320 million as cache bug lets attacker mint unbacked Bitcoin
The Liquid Network has suffered a significant security breach, allowing an attacker to exploit a cache bug in the Elements codebase, resulting in the minting of unbacked L-BTC and the draining of approximately $320 million worth of Bitcoin. The netwo...
Consumer tech news, reviews, and buying guides for gadgets and electronics.
"TechRadar is known for comprehensive buying advice, hardware reviews, and consumer tech news targeted at mainstream audiences."
— A47 Editor
Liquid Network halts new transactions after 'nice guy' hackers steal nearly all its Bitcoin — but then return most of it after a patch is issued
Liquid Network has suspended new transactions following a significant security breach where hackers, described as 'nice guys', stole nearly all of its Bitcoin. Fortunately, after a patch was issued, most of the stolen funds have been returned, allevi...
Beginner-friendly crypto tutorials, guides, and news.
"99Bitcoins is a crypto education and news site known for easy-to-understand content and comprehensive guides."
— A47 Editor
Bitcoin News Today: Liquid Network Still Paused After 3,400 BTC Is Returned
The Liquid Network remains paused after the return of 3,400 BTC, while 598 BTC is still outstanding. This situation follows a significant security breach where approximately 4,000 BTC was withdrawn by individuals claiming to be white-hat hackers. Sec...
Covers blockchain, cryptocurrency news, project analysis, and market insights.
"CoinDesk is a well-established cryptocurrency and blockchain news provider, offering comprehensive insights, market data, and industry research."
— A47 Editor
Liquid Network gets back 3,400 bitcoin from whitehat hackers; talks underway for the rest
The Liquid Network has successfully recovered 3,400 of the 4,000 bitcoin that were taken during a recent security breach attributed to purported whitehat hackers. The remaining 600 BTC, valued at approximately $47 million, is still outstanding as dis...
Covers blockchain, cryptocurrency news, project analysis, and market insights.
"Cointelegraph is a leading crypto-focused media outlet known for timely news, analysis, and educational content related to blockchain and digital assets."
— A47 Editor
Liquid ‘white hats’ return $270M in Bitcoin as network prepares restart
Following a significant security incident, purported 'white hat' hackers returned approximately $270 million in Bitcoin to Liquid, having initially withdrawn around 4,000 BTC from the network's federation wallet. This return represents 85% of the wit...
Real-time updates, analysis, and reports on the blockchain and cryptocurrency sectors.
"Crypto News delivers real-time updates, analysis, and reports on the blockchain and cryptocurrency sectors."
— A47 Editor
Liquid Network recovers 3,400 BTC after bridge exploit
Liquid Network has successfully recovered 3,400 BTC, valued at approximately $269.2 million, from hackers who had previously withdrawn 4,000 BTC, although $47 million remains unrecovered. This recovery follows a significant security breach that promp...
Curated tech headlines including AI stories.
"Influential aggregator surfacing the day’s top tech/AI links."
— A47 Editor
The attacker who withdrew ~4,000 BTC from Blockstream's Liquid Network federation wallet returns 3,400 BTC after Blockstream said its bridge nodes were patched (The Block)
An attacker who previously withdrew approximately 4,000 BTC from Blockstream's Liquid Network federation wallet has returned 3,400 BTC following Blockstream's announcement that its bridge nodes were patched. This incident highlights the vulnerabiliti...
Covers Bitcoin plus altcoin news, market updates, and educational resources.
"Bitcoin.com provides news, market data, and guides focused on Bitcoin and the wider crypto industry."
— A47 Editor
Liquid Hackers Return 3,400 BTC, Keep $47M as Network Stays Frozen
Hackers associated with the Liquid Network have returned 3,400 BTC, valued at approximately $47 million, while retaining a portion of the funds as the network remains frozen following a significant security breach. This incident has raised concerns a...
Bitcoin news, technical analysis, and forecasts across crypto markets.
"NewsBTC covers Bitcoin news, technical analysis, and forecasts across crypto markets and major blockchain projects."
— A47 Editor
Liquid Network Pauses After Purported $320M White-Hat Bitcoin Withdrawal
The Liquid Network has paused operations following a significant incident where approximately 4,000 Bitcoin, valued at around $320 million, was withdrawn by individuals claiming to be 'white hat' hackers. This withdrawal has raised serious concerns r...
Real-time updates, analysis, and reports on the blockchain and cryptocurrency sectors.
"Crypto News delivers real-time updates, analysis, and reports on the blockchain and cryptocurrency sectors."
— A47 Editor
Liquid attackers offer to return most of 4,000 BTC
Liquid's purported white hat hackers have offered to return most of the nearly 4,000 BTC, valued at approximately $320 million, that they withdrew from the Liquid sidechain after a security vulnerability was identified and patched by Blockstream. Thi...
Covers blockchain, cryptocurrency news, project analysis, and market insights.
"CoinDesk is a well-established cryptocurrency and blockchain news provider, offering comprehensive insights, market data, and industry research."
— A47 Editor
Bitcoin network used by exchanges hit by $320 million exploit. Hackers claim they're the 'good guys'
The Liquid Network, a settlement layer utilized by cryptocurrency exchanges, has suspended all transactions following a significant security exploit that resulted in the loss of $320 million worth of bitcoin. This incident has raised alarms about the...
Covers Bitcoin plus altcoin news, market updates, and educational resources.
"Bitcoin.com provides news, market data, and guides focused on Bitcoin and the wider crypto industry."
— A47 Editor
Blockstream Hunts ‘White Hats’ After 4,000 BTC Leaves Liquid
Blockstream is actively seeking 'white hat' hackers after a significant incident where 4,000 BTC was withdrawn from its Liquid Network, raising concerns about the security of its systems. This event follows a series of vulnerabilities identified by A...
Tech startup news, programming trends, and discussions shared by the developer community.
"Hacker News is a community-driven source highlighting influential tech discussions, startup launches, and programming insights."
— A47 Editor
Hackers have withdrawn ~4k BTC (~$320M) from the Liquid Federation wallet
Hackers have successfully withdrawn approximately 4,000 BTC, valued at around $320 million, from the Liquid Federation wallet, marking a significant breach in cryptocurrency security. This incident highlights vulnerabilities in systems that were prev...
Research, news, and analysis on blockchain startups, DeFi, and regulations.
"Crypto Briefing provides research, news, and analysis on blockchain startups, DeFi, and crypto regulations with investor-focused coverage."
— A47 Editor
Liquid halts network after white-hat hackers withdraw $320M in Bitcoin
The Liquid network has been halted following a significant incident where white-hat hackers withdrew $320 million in Bitcoin, raising alarms about the security of federated sidechain models. This breach has prompted immediate scrutiny of the platform...
Covers Bitcoin plus altcoin news, market updates, and educational resources.
"Bitcoin.com provides news, market data, and guides focused on Bitcoin and the wider crypto industry."
— A47 Editor
‘We Are Whitehats’: Nearly 4,000 BTC Drained From Blockstream’s Liquid Peg
Nearly 4,000 BTC was drained from Blockstream's Liquid Network, prompting the company to seek 'white hat' hackers to investigate the incident. This significant withdrawal raises serious concerns about the security of Blockstream's systems, especially...