Liquid Recovers Most of $320M Bitcoin Drain as Restart Nears

Liquid Network has recovered most of the Bitcoin removed from its federation reserves after the actors behind the September 6 incident returned 3,400 BTC, worth about $270 million.

Summary:

Most of the withdrawn Bitcoin is back in Liquid’s federation wallet.
Part of the funds remains with the actors, with no confirmed bounty agreement.
Evidence points to an Elements software bug rather than stolen authorization keys.
Liquid remains paused while operators complete fixes and prepare the restart.

The repayment, shared by mempool, followed Blockstream’s confirmation that affected bridge nodes had been patched, but Liquid remains paused as federation members work toward a coordinated restart.

An Onchain Negotiation Led to the Bitcoin Return

The recovery followed an unusual exchange conducted through the Bitcoin blockchain itself.

After the withdrawal, the actors identified themselves as “white hats” and communicated with Blockstream through messages embedded in Bitcoin transactions. They told the company to fix the underlying vulnerability and ensure affected nodes were patched before the funds would be returned.

Blockstream later responded with a PGP-signed onchain message confirming that its bridge nodes had been patched and that it was safe to send the Bitcoin back.

Following the recent incident affecting the Liquid Network and the movement of funds, Blockstream, as Liquid’s technical provider, and the Liquid Federation have been working diligently to resolve the ongoing situation and ensure the return of assets.

Updated software has been…

— Blockstream (@Blockstream) September 8, 2026

About 598.5 BTC, worth roughly $47 million, remained with the actors after the transfer.

Neither Blockstream nor Liquid has publicly described those coins as an agreed bug bounty or disclosed terms allowing the group to retain them. Ledger CTO Charles Guillemet has questioned the “white hat” description for that reason, arguing that keeping such a large amount without publicly known bounty terms does not resemble a conventional security disclosure.

The label therefore remains the actors’ own description, rather than an established characterization of the incident.

The Exploit Did Not Require a Stolen Peg-Out Key

The technical path behind the withdrawal is more consequential than the partial recovery.

Liquid’s federation wallet held roughly 4,200 BTC before the incident. About 4,000 BTC was withdrawn through SideSwap’s peg-out process, temporarily removing around 95% of the Bitcoin held in the wallet.

SideSwap said the affected transaction began with 4,000 L-BTC being submitted to its peg-out service. The tokens passed through a valid authorization process and were burned, after which the Liquid Federation released the corresponding native Bitcoin.

But SideSwap says its Peg-out Authorization Key was not compromised.

Instead, Blockstream determined that the L-BTC involved in the withdrawal had been created through a bug in Elements, the open-source software underlying Liquid, according to SideSwap.

That changes how the incident should be understood. The available evidence does not point to an attacker simply stealing a private key and signing an unauthorized withdrawal. The more serious question is how improperly created L-BTC was able to enter a process that ultimately released genuine BTC from federation reserves.

A complete technical post-mortem has not yet been published, leaving the exact failure path and its broader implications open.

Why the Missing Bitcoin Still Matters for L-BTC

Liquid is a Bitcoin sidechain where users can lock BTC and receive L-BTC, which is designed to represent Bitcoin on the network at a one-to-one ratio.

That model makes the federation’s Bitcoin reserves central to the system. When BTC leaves those reserves without a corresponding legitimate redemption, the issue is not limited to the dollar value of the exploit. It raises questions about the assets supporting L-BTC still in circulation.

Recovering most of the withdrawn funds has substantially reduced that pressure, but it has not automatically established that every outstanding L-BTC is once again fully backed.

Blockstream has not yet published a complete reserve reconciliation showing the post-incident position, nor has it explained how any remaining gap would be handled if the actors keep the Bitcoin still under their control.

For L-BTC holders, those details matter more than the “white hat” debate. The practical questions are whether their tokens remain fully redeemable for BTC and when that redemption mechanism will become available again.

Liquid Remains Paused Ahead of a Coordinated Restart

Blockstream says updated software has already been deployed, while federation members are preparing the network for a coordinated restart. Further security work is also underway following the incident.

Until that process is completed:

Liquid remains paused.
Public bridge nodes are still affected.
L-BTC deposits and withdrawals remain restricted at participating services.
Users have been advised not to send BTC to Liquid peg-in addresses until the restart is confirmed.
No firm reopening time has been announced.

The restart itself will therefore be the first operational test of the repairs. Restoring transaction processing is only part of it. Liquid will also need to demonstrate that the path used in the incident can no longer produce unauthorized BTC withdrawals and that normal peg-in and peg-out activity can resume safely.

The return of most of the Bitcoin has shifted the immediate problem from asset recovery to system integrity. What comes next is less about how much money came back and more about whether Liquid can account for its reserves, explain the Elements flaw and reopen the bridge without exposing users to the same failure path.

The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.

Author

Alexander Stefanov

Reporter at CoinsPress

Alex is Editor-in-Chief of Coinspress and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.