Bitcoin sidechain recovers 3,400 BTC after hack

TLDR

A recent exploit on the Liquid Network, a Bitcoin sidechain, saw about 4,000 BTC drained, with around 3,400 BTC now returned but the network still partially frozen.

1. Liquids attackers minted unbacked L-BTC, drained roughly 4,000 BTC from reserves, then returned about 3,400 BTC after Blockstream patched the vulnerability.
2. Around 598.5 BTC, worth about 47 million USD, remains with the attackers, and peg-ins and peg-outs for L-BTC are still suspended.
3. The incident highlights operational risks in federated sidechains and will likely delay broader institutional comfort with Bitcoin-based settlement layers.

Deep Dive

1. What Happened And What Was Recovered

On September 6, 2026, an exploit in Elements, the software underlying Liquid, let an attacker mint unbacked L-BTC and redeem it for real BTC via the SideSwap peg-out system, draining roughly 4,000 BTC from the federation wallet, about 320 million USD at the time. Multiple reports confirm that after Blockstream patched affected bridge nodes, the self-described white-hat hackers returned 3,400 BTC to the federation wallet, restoring roughly 85 percent of the drained reserves. This partial recovery is visible in on-chain records and summarized in coverage from outlets such as CryptoBriefing and CryptoSlate, which both note that about 598.5 BTC remains unrecovered at the attacker address.

2. Impact On Liquid Users And Bitcoin

Liquid Network halted its bridge nodes and L-BTC operations, and exchanges supporting L-BTC have paused deposits and withdrawals, leaving holders unable to redeem L-BTC for base-layer BTC until the federation confirms full backing and restarts the sidechain. Even though no federation keys were compromised and the bug sat in the transaction validation logic, confidence in Liquids one-to-one backing model is damaged until reserves and L-BTC supply are reconciled. Broader Bitcoin markets saw limited price impact because the incident is isolated to the sidechain; the base chain did not lose coins, but the episode reinforces that risks often sit in the layers around core blockchains, not in the consensus itself.

3. What To Watch Next

Negotiations between Blockstream and the attackers are ongoing over the remaining 598.5 BTC, which some security experts have described as closer to self-declared ransom than a clean bug bounty. Liquid remains paused while updated software is deployed, chain split issues are resolved, and a coordinated restart is prepared, with no firm public timeline yet for restoring peg operations. At a higher level, regulators and institutions are watching this and other infrastructure hacks as evidence that sidechains and bridges need tighter operational discipline, faster patch deployment, and possibly higher security and capital standards before they are trusted for large settlement flows.

Conclusion

Liquids recovery of 3,400 BTC significantly reduces the immediate collateral shortfall, but unresolved missing funds and suspended peg services keep trust and liquidity risks elevated for L-BTC users. For Bitcoin itself, the episode is a reminder that most systemic risk sits in sidechains, bridges, and custody layers, making security and operational rigor around these systems just as important as the strength of the base chain.