A possible bug in software could have been exploited by hackers: 4,000 bitcoin drained from the sidechain’s federation wallet
On 6 September 2026, hackers withdrew roughly 4,000 bitcoin (valued at about US$320m) from the Liquid Network’s federation wallet on Sunday, forcing the Bitcoin sidechain to suspend all activity while Blockstream attempts to establish contact with the actors behind the withdrawal.
The outflow represented approximately 95% of Liquid’s reported bitcoin reserves, which totaled around 4,200 BTC prior to the incident; the federation wallet now holds just over 207 BTC, according to Blockstream’s proof-of-reserves page.
The funds were moved using the SideSwap Peg-out Authorization Key, although Liquid stated that neither this key nor any other federation keys had been compromised.
SideSwap, a federation member responsible for executing peg-outs on behalf of users, confirmed its key had not been breached, and said Blockstream determined the L-BTC involved in the transaction was created due to a bug in the Elements software.
Heist details
According to Bitcoin Magazine, the attackers appear to have exploited an inflation vulnerability on the sidechain to mint more than 4,000 LBTC that did not previously exist, then redeemed them for real bitcoin from the federation’s 11-of-15 multisig wallet. Because the transactions appeared valid under the flawed consensus rules, the federation members’ hardware security modules automatically signed off on the withdrawal. Also:
- Two transactions confirmed in block 965,780 moved the funds to a single address, as reported by The Defiant.
- Four hours later, the recipient consolidated the bitcoin and attached a message via the OP_RETURN data field stating: “we are whitehats. contact us on chain”.
- Blockstream responded on-chain with a message directing the hackers to its security email. A separate transaction from a third party offered a Signal contact, although JAN3 CEO Samson Mow noted that message “did not come from the same address” holding the funds.
- Subsequently, bridge nodes had been disabled, effectively freezing the sidechain, and exchanges were instructed to pause LBTC deposits and withdrawals.
- Other assets issued on Liquid, including Tether (USDT), DePix, and tokenized real-world assets, were unaffected. Mow said Aqua wallet’s Liquid features were impacted but that on-chain bitcoin transactions continued to function, adding, “Everyone is actively working to resolve this. These are difficult times but we’ll pull through.”
- Ledger chief technology officer Charles Guillemet has questioned whether the conduct aligned with responsible disclosure norms, writing, “White hats don’t drain a bridge and then solicit an ‘on-chain’ contact,” while allowing that “this could be people with good intentions that intensively played with recent LLMs and are not used to responsible disclosures.”
Investigations ongoing
Users holding LBTC currently have limited options. The underlying bitcoin is not redeemable while the network remains paused, and the confidential nature of Liquid transactions makes it difficult to determine how much LBTC is held by retail users versus institutions.
Crypto analyst DBCrypto has noted the coins have not been mixed, and remain stationary on-chain — behavior “more consistent with a whitehat extraction than a theft.”
In May 2026, Blockstream had published a roadmap that included work on a “BitVM-style 1-of-n bridge” designed to reduce reliance on the federated multisig, but that system is not yet live — and Sunday’s withdrawal went out through the very architecture it was meant to replace.
