Liquid Network Exploit Drains $320M, Blockstream Halts Sidechain

Attackers claiming white-hat status drained close to 95% of the Liquid Network’s Bitcoin reserves The exploit abused a validation bug in Elements to mint unbacked L-BTC and peg out real Bitcoin No private keys were compromised, and every signature on the withdrawal was valid Blockstream paused the sidechain and is negotiating a return through messages written into Bitcoin blocks Blockstream halted its Liquid Network on Sunday after attackers who call themselves white hats withdrew roughly 4,000 BTC, worth about $320 million, from the federation wallet that backs the sidechain’s L-BTC token. The withdrawal cleared through SideSwap, a peg-out partner whose authorization key sits on the federation whitelist, and it emptied close to 95% of the Bitcoin held in reserve. Blockstream disabled the bridge nodes within hours and froze L-BTC deposits and withdrawals. By Monday afternoon the coins had not moved, and both sides were trading conditions for their return in messages written into Bitcoin blocks. We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message. What we know so far is that the funds… — Liquid Network (@Liquid_BTC) September 6, 2026 The Elements bug let attackers print L-BTC that no Bitcoin backed The attackers never stole a key. They found a validation flaw in Elements, the open-source software that runs the sidechain, and used it to mint L-BTC that no Bitcoin backed. That fake L-BTC entered SideSwap’s authorized peg-out service as a routine customer order. The system did exactly what a peg-out is built to do: it burned the incoming L-BTC and released real Bitcoin from the reserve to a fresh address. Block 965,783 settled the 3,996 BTC withdrawal at 14:28:56 UTC in a single 83-input transaction. The peg wallet started Sunday with about 4,200 BTC and ended with roughly 200. SideSwap says the L-BTC came from the Elements bug, not from any of its systems, and Blockstream confirms no key was compromised. Bitcoin developer Adam Simecka, founder of MannaBitcoin, framed the timing as the core problem, arguing that Blockstream had been patching an older Elements vulnerability in phases and disclosed where it sat before every node applied the fix. He offered no evidence for intent and called both a serious blunder and a deliberate scapegoat technically plausible. Blockstream has not confirmed how the bug was found or whether the public patching is linked to the drain, and no technical post-mortem has been published. Eleven functionaries signed a withdrawal the software swore was clean Liquid’s defenses held right up until they failed.