Liquid Network Hack: $320 Million In Bitcoin Walked Out, And The Hacker Wants To Give It Back

Bitcoin's oldest sidechain just lost almost everything it was holding, and the person who took it is asking politely how to give it back. On Saturday, 6 September 2026, roughly 4,000 $BTC worth about $320 million left the federation wallet that backs Liquid Network, the Blockstream-built Bitcoin sidechain that has been running since 2018. The wallet held around 4,200 BTC before the incident. It now holds a little over 200. That is about 95% of every Bitcoin ever pegged into Liquid, gone in the space of 23 minutes. Then things got strange. The attacker attached a message to a Bitcoin transaction announcing himself as a white hat and inviting Blockstream to get in touch. Blockstream did. The two sides have spent the weekend negotiating a $320 million return in public, one small Bitcoin transaction at a time. What Actually Happened In The Liquid Network Hack? The timeline is unusually clean, because most of it is on the Bitcoin blockchain. At 14:05 UTC on 6 September, a customer sent 4,000 L-BTC to SideSwap's peg-out service. SideSwap is a Liquid Federation member and a normal, approved route for converting L-BTC back into real Bitcoin. It processed the order like any other: the L-BTC was burned on Liquid, a valid peg-out authorisation was attached, and 23 minutes later the federation paid out roughly 3,996 BTC on the Bitcoin mainchain. Nothing about that transaction looked wrong. It was confirmed in Bitcoin block 965,783 at 14:28:56 UTC, and the coins landed in a single address holding just under 4,000 BTC. Shortly afterwards, that same address broadcast a tiny second transaction carrying an OP_RETURN message: the sender identified himself as a white hat and asked to be contacted on-chain. Blockstream replied the same way, sending 1,000 satoshis to the address in block 965,822 with a message pointing to its security contact. The conversation has since moved into PGP-signed notes passed back and forth. Liquid disabled its bridge nodes and paused the network. Exchanges were notified, and several have suspended L-BTC deposits and withdrawals. How Did The Elements Bug Let 4,000 BTC Out? This is the part that should worry people more than the missing money. Liquid's security model looks solid on paper. The Bitcoin backing L-BTC sits in an 11-of-15 multisig controlled by vetted federation members, and peg-outs back to Bitcoin are gated by a second layer called Peg-out Authorisation Keys. Neither of those layers broke. No key was stolen, no signer was phished, no hardware security module was tricked. Instead, Blockstream has attributed the incident to a software bug in Elements, the open-source codebase Liquid runs on. Independent analysis points to a consensus-level inflation bug in how confidential transaction rangeproofs were cached.