EL7.AI
CryptoMediumUpdated×3•Originally published 7 September 2026•Updated 8 September 2026•
2 min read

Liquid Recovers 3,400 BTC After $320 Million Incident; 598.5 BTC Remains Outstanding

Bitcoin coins flying out of a high-tech vault door against a textured orange background.

Key Facts

1About 4,000 BTC worth approximately $320 million was withdrawn on September 6, 2026, from a wallet holding about 4,200 BTC.
2The SideSwap transaction burned 4,000 LBTC under a valid authorization before about 3,996 BTC was paid out.
3A total of 3,400 BTC was returned on September 7, 2026, leaving about 598.5 BTC outstanding and putting recovery at roughly 85%.
4LBTC is designed to be backed 1-to-1 by BTC, and Blockstream's update did not specify a network-restart time.

The parties describing themselves as white-hat hackers returned 3,400 BTC to the Liquid Federation wallet on September 7, 2026, after withdrawing about 4,000 BTC worth approximately $320 million on September 6. About 598.5 BTC remained under their control, putting the recovered share at roughly 85%.

The incident began when 4,000 LBTC was sent to SideSwap's peg-out service, which burned the tokens under a valid authorization before the Liquid Federation paid about 3,996 BTC to the customer's address. Liquid and SideSwap said the PAK, other keys and systems were not compromised; SideSwap linked the LBTC used in the transaction to a flaw in the underlying Elements software.

Liquid disabled bridge nodes and stopped new transaction submissions, while exchanges suspended LBTC deposits and withdrawals. The network said other issued assets, including USDT, DePix and tokenized real-world assets, were not directly affected. The impact also remained separate from the Bitcoin base network.

Liquid is an independent sidechain connected to Bitcoin through a two-way peg. Under normal operation, LBTC is designed to be backed 1-to-1 by BTC held by the federation; a peg-out burns LBTC before an equivalent amount of BTC is sent to an address belonging to a federation member.

Blockstream communicated with the parties through signed messages recorded on Bitcoin. After they made remediation of the flaw and node updates a condition for returning funds, Blockstream said the bridge nodes had been patched, and 3,400 BTC was then returned in the transaction confirmed in block 965,950. Blockstream later said updated software had been deployed and federation members were preparing a coordinated restart.

The recovery restored most of the BTC that left the reserve, but it did not close the remaining 598.5 BTC gap. The priorities are therefore to recover the outstanding balance or address the shortfall, verify the integrity of the peg, and safely resume the bridge and LBTC deposits and withdrawals. Blockstream's published update did not specify a restart time.

Open on chart