Vulnerabilities · 50 days ago
Blockstream said an Elements bug let someone take nearly 4,000 bitcoin from the Liquid Network on September 6, then return 3,400 bitcoin the next day, leaving about 598.5 bitcoin unreturned while the network stays paused. Liquid backs its L-BTC token with real bitcoin, so the incident hit the reserve that supports redemptions, not just a single wallet.
The flaw sat in Liquid’s sidechain software, not in the release keys: SideSwap and Blockstream both said the Peg-out Authorization Key was not compromised, and the bug let the system accept a peg-out it should not have approved. That means the attacker could trigger a real bitcoin release by making the protocol believe the withdrawal was valid.
For operators and desks that hold L-BTC, the important exposure is still the same after the partial return: redemptions remain frozen until the federation restarts the network. The leftover bitcoin also leaves open a separate question the reporting does not settle — whether the return was a negotiated settlement or just change from the original transaction.
4 sources covering this story
The Record from Recorded Future
'White hat' hackers take $47 million bounty after $320 million crypto theft
Public negotiations between hackers and the operators of the Liquid Network crypto platform ended with the attackers sending back most — but not all — of what they took.
Hackers Return $263 Million Stolen From Liquid Network
Alleged ‘white-hat’ hackers drained $320 million from Liquid’s federation wallet, demanding a bug fix.
Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
Liquid received 3,400 bitcoin back after nearly 4,000 BTC was taken; 598.5 BTC remains unreturned and the network is still paused.
Hackers drain $320M in Bitcoin from Liquid Network, claim they're the good guys
Self-described white hats promise to return 'most' of the 4,000 BTC once the vulnerability is fixed
Part of the PlainSec briefing for 2026-09-09