NEARLY 4,000 bitcoin siphoned from the Liquid Network over the weekend has been partially returned. On 7 September 2026 (UTC), a total of 3,400 bitcoin was moved to a Liquid Federation address, with roughly 598.5 bitcoin remaining unreturned as of 8 September. The 3,400 bitcoin were sent via SideSwap’s Peg-out Authorization Key, one of the keys used to release funds from the Liquid sidechain.
Liquid’s federation is the operator group backing L-BTC, the token that is pegged to real bitcoins held on the Liquid network. The network remains paused, so holders cannot redeem L-BTC for bitcoin while the incident is investigated.
Blockstream, which provides the Liquid technology, acknowledged the event in an incident notice after hackers who claim to be white hats withdrew about 4,000 bitcoin from the federation wallet, valuing the amount at around $320 million at the time. The remaining 598.5 bitcoin was described as change from the same transaction and appeared at an address tied to the original transfer as of 8 September. Blockstream stated that the peg-out key was not compromised, nor were any other keys.
SideSwap and Liquid later said neither their systems nor their keys were breached. The withdrawal prompted a coordinated restart of Liquid’s infrastructure, with federation members patching nodes and updating software; Blockstream said funds were safe to return and that updated software had been deployed. Not all observers accept the “white-hat” framing, with some suggesting the outcome resembles a negotiated reward rather than a simple bug fix.