Liquid Recovers 85% of $320M Bitcoin Drain as Attacker Keeps $47M

Points of Focus

• Liquid recovered 3,400 BTC, about 85% of the nearly 4,000 BTC withdrawn.
• Another 598.5 BTC worth roughly $47.2 million remains under the actor’s control.
• Updated software has been deployed as Liquid prepares for a coordinated restart.

Liquid Network recovered 3,400 BTC worth about $268 million after a self-described white-hat party withdrew nearly 4,000 BTC from its federation wallet. 

The Sept. 7 return recovered about 85% of the Bitcoin involved in the $320 million incident, while another 598.5 BTC worth roughly $47.2 million remains under the actor’s control.

Liquid gets 3,400 BTC back after bridge patch

Lookonchain tracked the 3,400 BTC return after Blockstream sent a signed onchain message saying its bridge nodes had been patched and the funds were safe to return. The actors had earlier told Blockstream they would return most of the Bitcoin after the bug was fixed and affected nodes were patched.

The white-hat hacker has returned 3,400 bitcoin:native ($268.16M) to Liquid Network.

The remaining 598.5 bitcoin:native ($47.2M) was moved to a new wallet, possibly as the bounty.https://t.co/Of1IpL6RP4https://t.co/HICU6Q7Xgm pic.twitter.com/LoXdxm7onr

— Lookonchain (@lookonchain) September 8, 2026

The incident began on Sept. 6 when roughly 4,000 L-BTC reached SideSwap’s peg-out service. SideSwap said it burned the tokens through a valid peg-out authorization, after which the Liquid Federation released 3,996 BTC to the customer’s Bitcoin address. Neither SideSwap’s systems nor its peg-out authorization key was compromised.

SideSwap said Blockstream later traced the problem to a bug in Elements, the software underlying Liquid, that had allowed the L-BTC involved in the withdrawal to be created improperly. The evidence therefore points to a software validation failure rather than compromised federation or SideSwap custody keys.

$47M remains with actor as Liquid prepares restart

The remaining 598.5 BTC stayed under the actor’s control after the 3,400 BTC repayment. The retained amount represents about 15% of the nearly 4,000 BTC involved in the withdrawal and is equal to 17.6% of the amount returned. 

CertiK described the $47 million balance only as a potential bounty. Neither Liquid nor Blockstream has publicly disclosed bounty terms for the incident or evidence that the actor was authorized to retain the 598.5 BTC.

#CertiKInsight 🚨

The white hat returned 3,400 BTC (~$268M) to @Liquid_BTC , keeping 598.5 BTC (~$47M), which is 15% of the total amount.

This could potentially be a bounty reward.https://t.co/tJIWXaxu28

— CertiK Alert (@CertiKAlert) September 7, 2026

Ledger CTO Charles Guillemet questioned the white-hat label after the partial return. He argued that retaining nearly 600 BTC without disclosed terms would look more like extortion than a conventional bug bounty.

So, 3,400 BTC were refunded. The “white hats” still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!
Let's see what happens to these 600 BTC… https://t.co/nb1p9COmBk pic.twitter.com/BBKLrMVsqd

— Charles Guillemet (@P3b7_) September 7, 2026

The original withdrawal removed about 95% of the roughly 4,200 BTC held in Liquid’s federation wallet, according to Reuters. Public reserve data showed about 197.47 BTC remaining against roughly 4,205.02 L-BTC before the repayment.

 Adding the 3,400 BTC return raises the implied reserve to about 3,597.47 BTC, equal to roughly 85.5% of that L-BTC base and leaving an estimated 607.5 BTC gap. Liquid and Blockstream have not disclosed a reserve top-up or another mechanism covering the shortfall, and no official post-return backing ratio has been published.

Blockstream said updated software has been deployed and federation members are preparing a coordinated restart. As of Sept. 8, no public timetable had been announced for restoring normal Liquid operations.