Liquid Network has recovered 3,400 BTC from the actors behind the withdrawal of roughly 4,000 BTC from its federation wallet, materially reducing the losses from one of the largest incidents involving a Bitcoin sidechain. About 85% of the withdrawn Bitcoin has now been returned, while approximately 598.5 BTC, worth around $47 million, remains outside the federation’s control. Reuters had previously confirmed the initial withdrawal, valued at roughly $320 million.
The return was confirmed on-chain in Bitcoin block 965950 on September 7, where a transaction sent exactly 3,400 BTC back toward the federation peg wallet while returning 598.49955894 BTC to the holder address. The repayment followed a series of signed and encrypted on-chain communications after Blockstream indicated that affected bridge nodes had been patched.
Update: 3,400 BTC of the roughly 4,000 BTC withdrawn on September 6 has been returned to the @Liquid_BTC Federation wallet. The return followed confirmation from @Blockstream that the affected bridge nodes have been patched. Approximately 598 BTC remains outstanding, and…
— Samson Mow (@Excellion) September 7, 2026
Blockstream Patches Liquid Bridge Infrastructure
The actors responsible described themselves as white-hat hackers and said they had identified a vulnerability related to Elements, the software underlying Liquid. Their white-hat characterization remains disputed and should not be treated as independently established, particularly while nearly 600 BTC remains under their control.
The original incident involved approximately 4,000 LBTC entering SideSwap’s peg-out service and being burned before close to 4,000 BTC was released from the federation wallet. Liquid said SideSwap’s Peg-out Authorization Key was not compromised. The incident therefore appears centered on the software path that allowed the LBTC and subsequent peg-out to be treated as valid rather than on theft of federation signing keys.
Liquid halted new activity following the withdrawal, disabled bridge nodes and asked exchanges to suspend LBTC deposits and withdrawals. The network remained paused while operators coordinated patches and prepared infrastructure for a safe restart, meaning users continued to face temporary restrictions even after most of the Bitcoin returned.
The incident did not affect Bitcoin’s base-layer consensus. Liquid operates independently as an Elements-based Bitcoin sidechain, with BTC moved through a two-way peg and LBTC normally backed one-to-one by Bitcoin locked on the mainchain. The security failure was specific to Liquid’s sidechain infrastructure rather than the Bitcoin network itself.
Nearly 600 BTC Remains Outstanding
The recovery significantly improves the financial position of the federation, but it does not close the incident. Approximately 598.5 BTC remains with the actors after the 3,400 BTC repayment, leaving negotiations and potential recovery efforts unresolved.
The size of that retained amount has also complicated the white-hat narrative. Even if the initial withdrawal was intended to demonstrate a vulnerability, retaining roughly $47 million creates a separate question around compensation, authorization and the conditions attached to returning the remaining funds.
For Liquid operators and integrated exchanges, the immediate priority is restoring network consistency and validating patched infrastructure before reopening bridges. A secure restart will require more than recovering Bitcoin, with functionary coordination, exchange controls and confidence in the repaired peg mechanism all remaining critical.
The incident ultimately exposes the different security assumptions involved when Bitcoin moves onto federated infrastructure. Liquid has recovered most of the withdrawn BTC, but the final test will be whether it can recover the remaining funds and restart safely without recreating the conditions that allowed the withdrawal.
