Liquid Network recovers 3,400 BTC after exploit

TLDR

Liquid Network has recovered about 3,400 Bitcoin after a roughly 4,000 BTC bridge exploit, but around 600 BTC worth about $47 million remains unresolved.

1. Self-described white-hat hackers returned 3,400 BTC, about 85 percent of the withdrawn funds, while keeping roughly 598.5 BTC.
2. The exploit came from a bug in Liquids Elements software, not stolen private keys, and Liquids bridge and L-BTC transfers remain paused with depegging risk.
3. The key unknowns are how the remaining shortfall will be handled, when the network safely restarts, and what this means for trust in federated Bitcoin sidechains.

Deep Dive

1. What Was Recovered

Reports agree that about 4,000 BTC were drained from Liquids federation wallet backing L-BTC on 6 September 2026, roughly 95 percent of reserves. Self-described white-hat hackers then returned 3,400 BTC, around $268269 million, to the federation wallet, leaving about 598.5 BTC, roughly $47 million, still in an address linked to the withdrawal. Multiple outlets describe this recovery and shortfall, including crypto.news and Bitcoin.com.

The actors communicated via messages embedded in Bitcoin transactions, saying they would return most of the funds once the bug was fixed. Around 85 percent of the withdrawn BTC has now been recovered, but there is no public agreement explaining why they kept the remainder or whether it is meant as a bounty.

2. How The Exploit Worked And Who Is Affected

The vulnerability sits in Elements, the Bitcoin Core-derived software that Liquid uses. A range-proof verification cache bug appears to have allowed creation of unbacked L-BTC that could be redeemed for real BTC through normal peg-out flows, as detailed by Crypto Briefing.

Critically, reports say federation private keys were not compromised and peg-out service SideSwaps infrastructure was not directly breached. Still, Liquids bridge nodes are disabled and exchanges have halted L-BTC deposits and withdrawals, while other Liquid-issued assets and Bitcoins base layer continue operating. The unresolved 600 BTC shortfall means L-BTCs 1:1 backing is not fully restored and could cause L-BTC to trade at a discount to BTC.

3. What To Watch Next

Blockstream has told the actors in a signed on-chain message that bridge nodes are patched and safe to return the funds, a condition the hackers had set before repaying most BTC, according to Decrypt. Operators are preparing a coordinated restart of the sidechain, but there is no confirmed timeline.

Key open issues are whether the remaining 598.5 BTC will be recovered or replaced, how Liquid will restore full 1:1 backing, and what additional audits or architectural changes follow. Industry figures, including Ledgers CTO, have questioned whether keeping such a large retained amount is compatible with being white hats, highlighting reputational and regulatory risk for bridge-style systems.

Conclusion

Liquid Networks recovery of 3,400 BTC removes much of the immediate solvency shock, but the unrecovered 600 BTC and ongoing pause show how fragile federated bridges can be when their software layer fails. Until a full postmortem, clear restitution plan, and safe restart are published, L-BTC and similar wrapped assets on federated sidechains carry elevated counterparty and depegging risk that Bitcoin on the base layer does not.