Bitcoin sidechain hackers pledge 4,000 BTC return

TLDR

Purported white-hat hackers who drained about 4,000 BTC from Blockstreams Liquid sidechain say they will return most of the funds after a critical bug is fixed.

1. Around 4,000 BTC, roughly 95% of Liquids reserves, were withdrawn from the federation wallet, and the actors later pledged on chain to return most of it after a fix.
2. Liquid has paused its sidechain, disabled bridge nodes, and exchanges halted LBTC deposits and withdrawals, exposing serious peg and bridge risk even though base-layer Bitcoin is unaffected.
3. The key unknowns are whether the patch fully closes the vulnerability and whether the hackers actually send the BTC back, which will shape trust in Liquid and similar federated sidechains.

Deep Dive

1. What Actually Happened

On 6 September 2026, Liquid Network, a Bitcoin (BTC) sidechain operated by Blockstream, reported that approximately 4,000 BTC, worth about 320 million dollars, had been withdrawn from its federation wallet, representing about 95% of its pegged reserves. Reports say the withdrawal was executed via the SideSwap Peg out Authorization Key (PAK), but Liquid maintains the key itself was not compromised, pointing instead to a bug in the Elements software that underpins the sidechain.

The actors left an on chain message reading we are whitehats. contact us on chain and later told Blockstream that they would return most of the BTC once the vulnerability was fixed and every node was patched, according to detailed reconstructions of the on chain dialogue. These accounts note that, as of the latest updates, almost all of the BTC remains under the hackers control and has not yet been returned, despite the pledge to do so.

Several security experts, including Ledgers CTO, have questioned whether this behavior matches typical white-hat practice, comparing it to past bridge exploits, even as they acknowledge that open communication is a positive sign.

2. Impact On Users And Bitcoin

Liquid is designed so users lock BTC on the main chain and receive LBTC on the sidechain, with a federation holding the underlying BTC. Removing 4,000 BTC from the federation wallet means the peg is effectively undercollateralized until those coins come back, putting LBTCs backing in doubt.

In response, Liquid disabled bridge nodes and paused new transactions, while exchanges suspended LBTC deposits and withdrawals. Reports emphasize that other Liquid assets such as USDT and certain real-world asset tokens were not directly drained, but all Liquid wallets are impacted by the pause. Base-layer Bitcoin, and wallets that only use on chain BTC, continue to operate normally, yet the incident reinforces how bridge and sidechain risk can be very different from Bitcoins core security model.

3. What To Watch Next

Three signals matter now. First, a clear technical disclosure and patch from Blockstream and the Elements developers that explains the bug, how it is fixed, and how similar exploits will be prevented. Second, on chain movements from the hackers addresses that show whether BTC is actually flowing back to the federation wallet at scale. Third, exchange and market behavior when LBTC deposits and withdrawals eventually reopen, including any discount or volatility that suggests lingering distrust of the peg.

If the funds are substantially returned and the postmortem is credible, Liquid could recover, though with reputational damage. If not, this event will likely accelerate scrutiny of federated sidechains, bridging architectures, and concentrated trust assumptions in the broader Bitcoin ecosystem.

Confidence: moderate, because multiple independent reports and on chain messages align, while the hackers true intentions and final outcome remain uncertain.

Conclusion

A single software bug in the Bitcoin-adjacent Liquid sidechain allowed actors to pull out nearly all of the backing BTC, forcing a full network pause and exposing the fragility of pegged assets. Whether most of the 4,000 BTC is actually returned after the promised bug fix will determine if this remains a painful cautionary tale or becomes a full-blown loss event that reshapes how users and developers think about federated sidechains and cross-chain bridges.