Bitcoin layer-2 hackers return 3,400 BTC

TLDR

Hackers who drained around 4,000 BTC from the Liquid Network, a Bitcoin layer-2 sidechain, have returned roughly 3,400 BTC while keeping about 600 BTC.

1. The incident stemmed from a software bug that let attackers mint unbacked L-BTC and peg out about $320 million in Bitcoin, later returning most of it.
2. Liquid Network remains paused and its L-BTC sidechain tokens are not yet clearly fully backed, highlighting serious trust and bridge-risk issues for Bitcoin users.
3. Blockstream is still negotiating over the remaining ~598.5 BTC and preparing software fixes, and the outcome will shape confidence in Bitcoin layer-2s and federated sidechains.

Deep Dive

1. Exploit And Fund Return

On 6 Sep 2026, an unknown actor exploited a range-proof cache bug in the Elements code used by the Liquid Network. The flaw let them create about 4,000 unbacked L-BTC and use the SideSwap peg-out service to redeem them for real BTC, draining roughly 4,205 BTC down to about 200 BTC in the federation reserve.

The attackers, calling themselves white hats, then negotiated with Blockstream via messages embedded in Bitcoin transactions. After Blockstream patched affected bridge nodes, the group returned 3,400 BTC, keeping around 598.5 BTC (about $47 million) as a self-declared bounty, a move many in the industry view as closer to extortion than standard bug-bounty practice.

2. Impact On Liquid And Users

Liquid is a federated Bitcoin sidechain designed for faster settlement and more flexible asset issuance, with its L-BTC meant to be backed one-for-one by BTC in the reserve wallet. After the exploit, that backing was broken, and the network disabled bridge nodes while exchanges halted L-BTC deposits and withdrawals.

Even after the return of 3,400 BTC, Liquid remains paused and working to re-establish full backing. Users cannot safely assume L-BTC is fully collateralized or easily redeemable until the reserve, L-BTC supply, and bridge status are reconciled and publicly verified.

3. What To Watch Next

Blockstream and federation members are still negotiating to recover the remaining ~598.5 BTC and finalizing emergency software updates. Key milestones will be a confirmed network restart, clear disclosure on L-BTCs backing status, and whether the retained BTC is returned, replaced, or treated as a contentious bounty.

Beyond Liquid itself, this exploit is likely to influence how institutions view Bitcoin layer-2s and cross-chain bridges, pushing for stricter patch deployment processes, more robust audits of validation logic (not just custody), and possibly higher capital buffers or insurance requirements around sidechain operations.

Conclusion

The return of 3,400 BTC turns a total disaster into a partial recovery, but it does not erase the core problem: a critical validation bug in a Bitcoin layer-2 drained reserves and left users dependent on hacker goodwill. How Liquid resolves the remaining shortfall, restores full backing, and proves its security will shape market confidence not just in Liquid, but in the broader ecosystem of Bitcoin sidechains and bridges.