About 4,000 BTC worth $320 million was withdrawn from the Liquid Network’s federation wallet on 6 September, leaving 207 BTC behind. Blockstream traced it to a bug in its Elements software rather than a stolen key, and the white-hat hacker claim came from an on-chain message left by whoever moved the coins. None of it has been returned.
What Liquid Is and Why It Held 4,200 BTC
Liquid is a Bitcoin sidechain launched by Blockstream in 2018 for faster, more private transfers. Bitcoin locked on the main chain becomes L-BTC on Liquid, and a federation of more than 80 exchanges and infrastructure providers runs the network.
Moving that bitcoin needs 11 of 15 federation signatures, and a separate Peg-out Authorization Key system restricts payouts to approved wallets. Before 6 September, the wallet held about 4,200 BTC.
How the Liquid Network Hack Moved 4,000 BTC in 23 Minutes
A user sent 4,000 L-BTC to the SideSwap peg-out service at 14:05 UTC on 6 September. SideSwap processed it as a normal order, the L-BTC was burned on Liquid with a valid authorization, and at 14:28 UTC the federation paid 3,996 BTC to the customer’s Bitcoin address.
Liquid’s explorer then showed the federation wallet holding 207.275 BTC, down from about 4,200. The network disabled its bridge nodes, stopping new transactions, and told exchanges to suspend L-BTC deposits and withdrawals.
The L-BTC Came From a Software Bug, Not a Stolen Key
Blockstream established that the L-BTC in that order had been created through a bug in its Elements software, according to SideSwap. Because the withdrawal looked valid, the federation’s signing servers approved it in the normal way.
Liquid said the SideSwap Peg-out Authorization Key was not compromised, and neither were any others. A stolen key would mean the signing process failed, whereas a software bug means the process worked correctly on a transaction that should never have existed.
What the White-Hat Hacker Claim Actually Means
The white hat hacker label came from the attackers themselves. An on-chain message in the transaction said they were white hats and asked to be contacted on chain, Blockstream replied with a security contact address, and a later message pointed to a Signal handle.
None of the bitcoin has been returned. It has not moved from the address it was sent to, no party has been identified, and Liquid has not said when the network will restart, so nothing yet distinguishes this from an ordinary theft.
Why the Bitcoin Price Barely Moved
Bitcoin traded near $80,000 on 7 September, up about 0.5% on the day. The 4,000 BTC involved is roughly 0.02% of the 19.9 million bitcoin in circulation, so a $320 million headline barely registers against a $1.6 trillion asset.
The coins also still exist on the main chain, having moved to a new address rather than being destroyed, so no supply was lost and no Bitcoin rule was broken.
Read more: Bitcoin Price Prediction for September 2026
What BTC Holders Should Check
Bitcoin held on the main chain or on an exchange is unaffected. The exposure is L-BTC, the token that represents bitcoin on Liquid, and anyone holding it cannot deposit or withdraw while the sidechain is paused. Other assets issued on Liquid, including USDT and DePix, are working normally.
L-BTC is currently backed by 207 BTC instead of 4,200, and nobody has said how that gap gets closed. Watch whether the coins are returned, whether the federation covers the shortfall, and when exchanges reopen L-BTC transfers.
FAQs
Was the Liquid Network hack a Bitcoin hack?
The Liquid Network hack was not a Bitcoin hack, and coins held on the main chain or on exchanges were never at risk. The incident happened on Liquid, a separate sidechain run by Blockstream, and the bug sat in Blockstream's Elements software rather than in Bitcoin itself.
How much did the Liquid Network lose after the hack?
The Liquid Network lost about 4,000 BTC, worth $320 million, on 6 September, leaving 207.275 BTC in the federation wallet. That is 95% of the reserves backing L-BTC, the token that represents bitcoin on the Liquid sidechain.
What does white-hat hacker mean in the Liquid Network hack?
The white-hat label means nothing yet, because the people who took the coins gave it to themselves. A genuine white-hat hacker returns the funds, but in this case, none of the 4,000 BTC has come back.
Can I still withdraw L-BTC?
No, L-BTC withdrawals and deposits are suspended. Liquid disabled its bridge nodes and asked exchanges to pause L-BTC transfers, so the sidechain is frozen until the incident is resolved. Other Liquid assets, including USDT, are unaffected.
