Liquid sidechain hackers return most stolen BTC

TLDR

Hackers who drained roughly 4,000 BTC from the Liquid Network sidechain have returned about 3,400 BTC, but around 600 BTC remains unreturned and the network is still paused.

1. Purported white hat hackers exploited a bug to withdraw about $320 million in BTC, then sent back roughly 85 percent after Blockstream patched the software.
2. Liquids L?BTC token backing is still incomplete, leaving depeg risk and suspended bridge operations for users and exchanges that rely on the sidechain.
3. The key unknowns are what happens to the remaining BTC, how Liquid repairs the balance sheet, and when a safely patched restart is announced.

Deep Dive

1. What Happened And What Was Returned

Liquid Network is a Bitcoin sidechain where users lock BTC and receive faster, more private L?BTC in return, backed one to one by reserves. Reports show that attackers exploited a vulnerability in the Elements code that powers Liquid to create unbacked L?BTC and redeem it via the SideSwap peg?out service, draining about 4,000 BTC worth roughly $320 million from the federation wallet.

After public on?chain messages and negotiations with Blockstream, the actors returned 3,400 BTC, around $270 million, to the federation wallet once bridge nodes were patched, leaving about 598.5 BTC, valued near $47 million, still in the attacker?linked address. Multiple outlets confirm this sequence of exploit and partial restitution, including the recovery of 3,400 BTC and retention of approximately 15 percent of the haul as of early September 2026.

Confidence: high, based on converging technical and news reports.

2. Impact On Liquid And L?BTC Users

Because Liquids design assumes each L?BTC is backed by one BTC in the federation wallet, the remaining shortfall means L?BTC is no longer fully collateralized. Coverage notes that reserves fell from more than 4,200 BTC to under 200 BTC at the low point and that even after the return, a deficit persists, creating a risk that L?BTC could trade at a discount to Bitcoin until the gap is closed.

In response, bridge nodes are disabled and exchanges have suspended L?BTC deposits and withdrawals, effectively freezing the sidechains peg?in and peg?out functions while federated members work on a restart plan. Other assets issued on Liquid, such as USDT and certain real?world asset tokens, are reported as unaffected, and the main Bitcoin network itself was not compromised.

3. What To Watch Next

The biggest open questions are whether the remaining roughly 600 BTC will ever be returned and, if not, who absorbs that loss so L?BTC can regain one?to?one parity. So far, neither Liquid nor Blockstream has publicly framed the retained BTC as an agreed bounty, and some security experts have questioned whether the hackers truly qualify as white hats.

Practically, users should watch for three signals: a detailed post?mortem on the Elements bug and bridge architecture, a concrete plan for recapitalizing or restructuring L?BTC backing, and a formal announcement of a coordinated network restart with exchanges re?enabling L?BTC flows. More broadly, this incident reinforces that bridge and sidechain risks remain material even when core Bitcoin keys are not stolen.

Conclusion

Liquids bridge exploit shows that even sophisticated Bitcoin sidechains can suffer major reserve shocks from software flaws, yet also that partial recovery is possible when attackers engage and operators patch quickly. Until the remaining BTC is accounted for and a transparent restart plan is published, L?BTC users and exchanges face ongoing depeg and operational risk, underscoring the need to treat any multi?party peg mechanism as a separate security layer from Bitcoin itself.