Attackers Drained 4,000 Bitcoin From Blockstream’s Liquid Network. They Say They Are White Hats and Want to Give It Back.

Around 4,000 Bitcoin (CRYPTO:BTC), worth about $320 million, drained out of the Liquid Network federation wallet on September 6, 2026, and Blockstream says no private key was stolen. The wallet held about 4,200 BTC before, so 95% of the Bitcoin backing the sidechain left in one transaction. Blockstream paused the network and blocked redemptions, so holders of L-BTC, the token meant to represent Bitcoin one-for-one on Liquid, can’t convert it back into real coins.

Ordinary Bitcoin holders on the base layer aren’t affected, with Bitcoin’s price trading around $79,700–$80,000 at the time of the incident. The attackers attached a message to the transaction saying, “we are whitehats. contact us on chain,” and Blockstream responded on-chain the same day. A white hat is generally expected to report a vulnerability responsibly rather than take funds first, which makes the incident harder to classify. So how much of this is a real security event, and how much is theater?

What Liquid Is and Why L-BTC Depends on the Federation Wallet

Liquid is a Bitcoin sidechain, meaning it is a separate blockchain designed to move value faster and with more privacy than the Bitcoin base layer while keeping its main asset backed by real Bitcoin. Blockstream built Liquid, which has run since 2018, and a federation of 15 members operates it and jointly controls the multisignature wallet holding the underlying BTC.

When you peg in, you send real Bitcoin to the federation and receive L-BTC on Liquid. When you peg out, you burn L-BTC and the federation releases the corresponding amount of real Bitcoin back to you.

That one-for-one backing promise is what gives L-BTC its value. If the federation wallet holds less BTC than the L-BTC issued against it, the token becomes a partial claim on Bitcoin, worth whatever the market thinks it can eventually recover. The problem is limited to Liquid, so if you hold BTC directly on the Bitcoin base layer, your coins are not held in the federation wallet, and you are not exposed to this incident.

How the Coins Left the Federation Wallet

Blockstream says no key was stolen, which makes this look less like a conventional hack. At 14:05 UTC on September 6, someone sent 4,000 L-BTC to SideSwap, a federation member that processes peg-outs, and SideSwap said it handled the order like any other. The L-BTC was burned on Liquid with a valid authorization, and at 14:28 UTC the federation paid 3,996 BTC to the customer’s Bitcoin address.

Eleven of the federation’s fifteen keys signed the transaction because, under the network’s rules, it looked valid. Blockstream hasn’t published a full post-mortem, but early analysis points to a bug in Elements, the open-source code Liquid runs on, that let the attackers create L-BTC that was never backed by any Bitcoin.

The difference matters because a stolen key would be a custody failure that the federation could address by rotating its signers. However, a bug that lets someone mint unbacked tokens and redeem them through the normal process is a protocol failure, which is harder to dismiss as carelessness and harder to fix without changing how the peg works.

The attackers’ on-chain message read “we are whitehats. contact us on chain,” and Blockstream replied by sending 1,000 satoshis to the address with a message pointing to its security contact. The two sides have since exchanged PGP-signed notes, a cryptographic signing method that lets a receiver confirm a message really came from the claimed sender’s key.

According to on-chain messages reported by Galaxy Research’s Alex Thorn, the attackers have said they intend to return most of the funds once the vulnerability is patched. However, no agreement has been announced, and the network has not said when it will resume operations.

What an L-BTC Holder Owns While the Network Is Paused

If you hold L-BTC, your token still exists in your wallet, but you cannot convert it back into real Bitcoin while the network is paused. Every L-BTC in circulation is backed by the federation’s reserve, and about 95% of that reserve has been withdrawn.

Until Blockstream publishes updated figures for the reserve and the amount of L-BTC in circulation, no one can say exactly how much Bitcoin backs each token or when peg-outs will resume. The situation improved on September 7 when the attackers returned 3,400 BTC to the federation’s address. They kept about 598.5 BTC, worth roughly $47.3 million at the time, meaning most of the stolen Bitcoin was recovered, but the reserve was still short of the amount needed to fully back L-BTC.

Exchanges have suspended L-BTC deposits and withdrawals, while USDT and other assets on Liquid remain unaffected.

Does This Move Bitcoin, or Just Bruise Blockstream?

BTC has traded around $78,000 to $81,000 over the past week and is up 21% over the past month, with the Liquid hack having little to no visible impact on its price. The Bitcoin base layer did not lose any coins, and the market appears to have treated the incident as a problem with Liquid rather than with Bitcoin itself. 

The return of 3,400 BTC gives Liquid a path to recovery, but the incident is not over. About 598.5 BTC is still with the attackers, peg-outs remain paused, and Blockstream still needs to show that the remaining L-BTC can be fully backed by the federation’s reserves.

For Liquid to put the incident behind it, the missing Bitcoin needs to be returned or otherwise accounted for, peg-outs need to resume, and Blockstream needs to provide clear figures showing that the L-BTC supply matches the Bitcoin held in reserve. 

Until that happens, the biggest damage may not be to Bitcoin itself but to confidence in Liquid’s promise that every L-BTC can be exchanged for one Bitcoin.

Contact [email protected] for any questions or corrections.