2026-09-07

Liquid Network Hacked for $320 Million - 95% of Bitcoin Reserves Drained in Sidechain Software Bug

Written & reviewed by the TradeSmrt editorial team · 2026-09-07

In this article

What Happened
Why the Keys Weren't Stolen but the Money Still Left
Why This Matters Beyond the Crypto-Native Crowd
What to Take Away From This
FAQ
Sources

What Happened

On Sunday, September 6, Liquid Network - a Bitcoin-based settlement sidechain operated by Blockstream - confirmed that roughly 4,000 bitcoin, worth about $320 million at the time, had been withdrawn from its federation wallet. What makes this stand out is the scale relative to what was at stake: the wallet held only about 4,200 BTC before the incident, meaning roughly 95% of the network's entire reserve was drained in one event. This wasn't a partial breach - it was nearly the whole treasury.

Liquid Network is a "sidechain" Blockstream launched in 2018 to let exchanges and asset issuers settle Bitcoin-denominated transactions faster and more cheaply than on Bitcoin's main chain. It works by minting a pegged token called L-BTC, which is supposed to be backed one-to-one by real bitcoin locked in the federation wallet. That backing is the entire point of the system - and this incident hit precisely that collateral pool. In response, Liquid Network immediately disabled its bridge nodes, halting new transactions, and several exchanges paused L-BTC deposits and withdrawals while the situation is assessed.

Why the Keys Weren't Stolen but the Money Still Left

The most unusual detail here is that no private key was ever compromised. The withdrawal moved through SideSwap, a settlement platform that legitimately holds a "peg-out authorization key" (PAK) allowing it to process withdrawals from the network. In other words, nobody picked a lock - the front door opened normally, but far more money walked out through it than should have been possible. Blockstream traced the root cause to a validation bug in Elements, the software underpinning Liquid Network. Independent analysis points to a flaw in how the system cached "rangeproofs" - the cryptographic proofs that validate confidential transactions - using a cache key that failed to distinguish between different assets and script contexts. That gap allowed a previously verified proof to be reused in a context where it shouldn't have applied, effectively letting unbacked L-BTC be minted out of thin air. Because some nodes accepted these improperly created coins as valid, SideSwap itself couldn't distinguish the bug-created coins from genuine ones and treated all of them the same way - which is how the large withdrawal went through.

What makes this episode even stranger is the withdrawing party's own behavior. The individual or group behind it has been sending on-chain messages describing themselves as "white hat" actors and has reportedly offered to return the funds once the underlying bug is patched. On September 7, after Blockstream confirmed the underlying bug had been patched, the attacker made good on that offer - returning about 3,400 BTC, roughly 85% of what was taken, to Liquid Network's federation wallet. The remaining roughly 598.5 BTC (worth about $47 million, or about 15% of the total) stayed in the attacker's own wallet rather than being returned, effectively taken as a self-appointed "fee." That's a notable departure from how most malicious exploits play out - typically involving rapid laundering or cash-out attempts - and the industry is now watching whether that retained amount moves further and how Blockstream responds to it.

Why This Matters Beyond the Crypto-Native Crowd

This isn't a story that only matters to crypto insiders. Bitcoin's fortunes are now tightly wound into Nasdaq-listed names like Coinbase and Strategy (formerly MicroStrategy), and spot Bitcoin ETFs have pulled crypto exposure directly into mainstream portfolios. A confidence shock hitting Bitcoin-adjacent infrastructure is exactly the kind of event that can ripple into sentiment around those equities, even when - as here - the Bitcoin base layer itself was never at risk. The timing compounds the effect: Bitcoin had been chopping in the high-$70,000s to low-$80,000s this week, having clawed back roughly 23% from its early-August low but repeatedly failing to clear resistance near $82,000. Layering an infrastructure trust issue on top of an already indecisive price structure tends to weigh on risk appetite rather than help it.

There's also a broader pattern worth noting: this single incident accounts for nearly all of the roughly $322 million in crypto hacks recorded in just the first week of September. That comes at a moment when markets are already on edge ahead of the September 16 Federal Reserve meeting and this week's consumer price index release - both of which will shape how much further the Fed leans toward another rate hike. Adding a fresh doubt about the structural safety of crypto infrastructure, on top of macro uncertainty that's already been whipping Bitcoin around all week, raises the bar for what would need to go right for risk sentiment to stabilize. It's also a useful reminder that this exploit came from a logic flaw in verification code, not a stolen password or private key - a reminder that access controls alone don't guarantee an asset is safe if the underlying system it depends on has a bug.

What to Take Away From This

Custody safety isn't only about who holds the keys. This withdrawal moved through a legitimately granted authorization key; the failure was in the underlying validation logic the whole system relies on. When assessing any financial system's security - crypto or otherwise - evaluate both access controls and the robustness of the code those controls sit on top of.
Pegged or derivative assets don't automatically inherit their underlying asset's safety. L-BTC is supposed to be backed 1:1 by real bitcoin, but this episode shows that if the collateral mechanism itself breaks, the derivative can lose its backing even while the base asset (Bitcoin itself) remains completely unaffected. Know exactly what backs any asset you hold, not just what it's named after.
Headline severity and market impact don't always move in lockstep or on the same timeline. Here, most of the funds were back within a day of the patch being confirmed, so the final loss settled out far smaller than the initial $320 million headline implied. Track how a situation develops - not just the first alarming number - before drawing conclusions.
Small, localized risks get amplified when they land during a high-tension macro week. With the Fed's September decision and fresh inflation data both on deck, an event that might otherwise stay contained to crypto-native circles can spill over into broader risk sentiment more than it would in a quieter week.

FAQ

Does this hack put Bitcoin's price or the Bitcoin network itself at risk?

No. The exploit hit Liquid Network, a separate sidechain that issues a pegged token (L-BTC) built on top of Bitcoin - not Bitcoin's own base-layer protocol or security. Bitcoin's core network was never directly compromised. That said, incidents like this can still weigh on broader crypto market sentiment even without touching Bitcoin's own code.

Did the hacker actually return the funds?

Mostly, yes. After Blockstream confirmed on September 7 that the vulnerability had been patched, the attacker returned about 3,400 BTC - roughly 85% of what was taken - to Liquid Network. The remaining approximately 598.5 BTC (about $47 million, roughly 15% of the total) was kept in the attacker's own wallet rather than returned, and it isn't yet clear whether that amount was a pre-agreed bounty or simply retained unilaterally.

Does this affect ordinary Bitcoin holders who don't use Liquid Network?

Not directly. If you hold Bitcoin in a standard exchange account or personal wallet and have never used Liquid Network or held L-BTC, this incident doesn't directly touch your holdings. Anyone who does hold L-BTC or uses an exchange that offers it should check that platform's own announcements, since deposit and withdrawal restrictions may apply there.

Sources

This article is an original synthesis and analysis based on the reporting below, not a reproduction of the original articles. Please check the source articles directly for the most current figures.

⚠️ This article is for informational purposes only and is not investment advice. Market conditions change constantly - always verify the latest data before making investment decisions.