Liquid Network, 6–7 September 2026: 4,000 BTC left the federation wallet — what is on record
About 4,000 of the 4,200 bitcoin held by the Liquid Federation moved out on 6 September through an approved peg-out. Blockstream says no key was compromised and that a bug in the Elements software created the L-BTC involved. Self-described "white hats" are talking to Blockstream through on-chain messages and say they will return most of it once every node is patched. As of the morning of 8 September, no return is confirmed by Liquid itself.
On Saturday, 6 September 2026, roughly 4,000 bitcoin — about 95% of the reserve behind the Liquid sidechain — left the Liquid Federation's wallet in a single, valid-looking withdrawal. This entry records what the operator has said, what the people holding the coins have said, and what is still unconfirmed on the morning of 8 September. It is a documentary record, not an assessment of any asset.
Adam Back, co-founder and CEO of Blockstream, the company that built and maintains Liquid — photo: Joi Ito, 2014, CC BY 2.0, Wikimedia Commons.
What Liquid is
Liquid is a Bitcoin sidechain launched by Blockstream in 2018. Users lock bitcoin and receive L-BTC, a token that moves on the sidechain faster and with confidential amounts; a federation of exchanges, infrastructure firms and asset managers — Liquid says more than 80 members — holds the underlying bitcoin and signs the withdrawals ("peg-outs") back to the Bitcoin base layer. Peg-outs go through approved services holding a Peg-out Authorization Key (PAK).
What the operator has said (primary source)
On 6 September the Liquid Network account wrote on X that it was "aware of a security incident," that "purported white-hat hackers have withdrawn 4,000 BTC ($320 million) from the Liquid Federation wallet," and that Blockstream was contacting them on-chain with a signed message. The same statement said the withdrawal went through SideSwap's PAK, that "that key was not compromised, nor were any others," and that Blockstream had established the L-BTC in the order "was created through a bug in the Elements software." Bridge nodes were temporarily disabled, exchanges were asked to pause L-BTC deposits and withdrawals, and other Liquid assets (USDT, DePix, real-world assets) were described as unaffected.
SideSwap, the peg-out service used, posted its own statement: a customer sent 4,000 L-BTC to its peg-out service at 14:05 UTC, the order was processed "like any other," the L-BTC was burned with a valid authorisation, and at 14:28 UTC the federation paid out 3,996 BTC.
What the holders of the coins have said
According to a reconstruction published by Galaxy Research's Alex Thorn and reported by crypto.news and CoinDesk, the parties exchanged messages in Bitcoin OP_RETURN outputs. The first transaction from the withdrawing side carried "we are whitehats. contact us on chain." Blockstream answered at block 965,822 with a 1,000-satoshi transaction directing them to its security team, plus PGP-signed material. At block 965,869 the holders asked whether returning "most" of the bitcoin would be acceptable, and a later message said: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix."
What is not confirmed
As of the morning of 8 September, the Liquid Network account has not posted a confirmation that any bitcoin has been returned, has not published a patch version, a reopening time, or a technical post-mortem. Several secondary outlets report that a large part of the coins has since moved back to the federation and that a smaller amount was retained; we could not verify that against a statement by Liquid or Blockstream and do not record it as fact here. "Most" has not been defined by the holders. The "white hat" description is theirs; Liquid itself uses the word "purported."
Why it matters, plainly
Liquid exists to let exchanges settle bitcoin faster than the base layer allows. Its security model rests on the federation's custody of the reserve and on the rule that L-BTC can only exist against locked bitcoin. The operator's own account of this incident — a valid peg-out of L-BTC that a software bug had created — points to the second rule, not to stolen keys. That distinction is the one fact that separates this event from most of the year's exchange and bridge losses, and it is the one to watch when the post-mortem is published.
Why this is on our site
Data Analytic System documents primary-source events in the crypto infrastructure it reports on. A sidechain pause, an operator statement and an on-chain negotiation are dated, checkable records — the kind we anchor to. We will add the outcome from Liquid's or Blockstream's own release when it exists.
What this entry does not claim
It does not say whether the coins will be returned, how much, or when. It does not say what the bug is; Blockstream has not published it. It does not say what any asset will do. It does not evaluate the motives of the people holding the coins.
Sources:
- Liquid Network (@Liquid_BTC) on X, 6 September 2026 — https://x.com/Liquid_BTC/status/2096696272447218108
- SideSwap (@side_swap) on X, statement on the incident, 6 September 2026 — https://x.com/side_swap/status/2096709838310928674
- CoinDesk, "Bitcoin network used by exchanges hit by $320 million exploit. Hackers claim they're the 'good guys'", by Omkar Godbole, 7 September 2026 (updated 09:59 UTC) — https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys
- crypto.news, "Liquid attackers offer to return most of 4,000 BTC", by Olivia Stephanie, 7 September 2026, 07:43 UTC — https://crypto.news/liquid-attackers-offer-to-return-most-of-4000-btc/
- Blockstream Help Center, "What is the Liquid Federation?" — https://help.blockstream.com/liquid-network/faqs/what-is-the-liquid-federation
Educational content. Not investment advice.
Continue on DAI
Explore Topics
Written by
DAI Research Desk
Content creator and writer sharing insights and stories.
