Liquid Hackers Promise to Return 4,000 BTC
Liquid Network hackers say they will return most of 4,000 BTC after a vulnerability is fixed, following a $320M security incident.
Coinccino 
Liquid Hackers Say They Will Return Most of 4,000 BTC After Bug Fix
A group claiming to be white-hat hackers says it plans to return most of the roughly 4,000 BTC taken from the Liquid Network after the underlying vulnerability is fixed.
The Bitcoin was worth around $320 million at the time of the incident. Liquid has paused network activity while Blockstream investigates the breach.
What Happened?
Around 4,000 BTC was withdrawn from Liquid's federation wallet on September 6.
The incident represented roughly 95% of the network's reported Bitcoin reserves, which were around 4,200 BTC before the withdrawal.
The attackers later used on-chain messages to communicate with Blockstream and said the funds could be returned after the vulnerability is fixed.
Key Details
- Bitcoin moved: ~4,000 BTC
- Estimated value: ~$320M
- Incident date: September 6, 2026
- Network: Liquid
- Operator: Blockstream
- Reserve before incident: ~4,200 BTC
- Planned recovery: Most of the BTC
- Current status: Network activity paused
Why This Matters
The incident highlights the security risks surrounding Bitcoin sidechains and federation-based infrastructure.
Liquid is separate from Bitcoin's base layer, meaning the incident did not involve a compromise of Bitcoin's underlying network or consensus.
How the Attack Happened
Liquid said the funds were withdrawn through the SideSwap Peg-out Authorization Key (PAK) mechanism.
Importantly, Liquid said the cryptographic key itself was not compromised. The exact vulnerability has not been fully disclosed publicly.
Other reports have linked the incident to a bug in the underlying Elements software, although the precise technical root cause remains under investigation.
Hackers Request a Bug Fix
The alleged white-hat hackers have communicated with Blockstream using OP_RETURN messages and encrypted communications.
They reportedly said that most of the Bitcoin would be returned once the vulnerability is patched and all relevant nodes are upgraded.
However, the return has not yet been completed, so the recovery should be treated as a stated intention rather than a confirmed outcome.
Impact on L-BTC
The incident is particularly important for L-BTC, Liquid's Bitcoin-backed asset.
Because approximately 95% of the federation's Bitcoin reserves were removed, exchanges temporarily suspended L-BTC deposits and withdrawals while the situation was investigated.
Market Reaction
The incident has so far had a relatively limited direct effect on Bitcoin's broader market.
BTC remained around the $80,000 area, while the main concerns have centered on Liquid, L-BTC and users relying on the sidechain.
Bullish Scenario
If the vulnerability is successfully fixed and most of the BTC is returned:
- Liquid could gradually resume operations
- L-BTC confidence could improve
- Exchanges could restore services
- The incident could become a major security lesson rather than a permanent loss
Bearish Scenario
If the funds are not returned, Liquid could face significant challenges.
The loss of most reserves could undermine confidence in L-BTC and force deeper changes to the network's security architecture.
Key Events to Watch
- Blockstream's technical explanation of the vulnerability
- Completion of node patches
- Confirmation that the BTC has been returned
- L-BTC deposit and withdrawal resumptions
- Liquid's return to normal operations
What Investors Should Watch
The biggest signal will be on-chain movement of the 4,000 BTC.
Until the coins are actually returned, investors should treat the hackers' promise as unconfirmed.
FAQ
How much Bitcoin was taken?
Approximately 4,000 BTC, worth about $320 million at the time.
Will the hackers return the Bitcoin?
The individuals claiming to be white-hat hackers have said they will return most of the funds after the vulnerability is fixed, but the return has not yet been completed.
Was Bitcoin itself hacked?
No. The incident involved Liquid's sidechain infrastructure, not Bitcoin's base-layer consensus.
Is Liquid operating normally?
No. Liquid paused network activity following the incident while the vulnerability is investigated and patched.
Final Take
The Liquid incident is one of the largest recent security events involving Bitcoin-related infrastructure, but the potential recovery changes the situation significantly.
The key question now is simple:
Will the vulnerability be fully patched—and will most of the 4,000 BTC actually come back?
Until that happens, the recovery remains a promise rather than a confirmed outcome.
