Liquid receives 3,400 BTC back after Elements-related withdrawal
Hackers who withdrew nearly 4,000 bitcoin from the Liquid Network on September 6 returned 3,400 BTC to a Liquid Federation address the following day. The transfer, confirmed at 16:09 UTC on September 7, represented about 85% of the bitcoin taken. About 598.5 BTC remained at the address from which the funds had been sent, valued at roughly $47 million at a bitcoin price of about $78,000 on September 8.
Liquid is a Bitcoin sidechain whose L-BTC token is backed by bitcoin held by the Liquid Federation, a group of operators. The network remained paused as of September 8, meaning holders could not redeem L-BTC for bitcoin. Before the incident, Liquid reportedly held about 4,200 BTC in reserves; the withdrawal represented roughly 95% of that amount.
Elements bug cited in the withdrawal
Blockstream, which provides technology for Liquid, said attackers describing themselves as white hats took about 4,000 BTC from the federation wallet, worth approximately $320 million at the time. The bitcoin was released through SideSwap’s Peg-out Authorization Key, a key used in the process that destroys L-BTC on the sidechain and releases corresponding bitcoin on the Bitcoin main chain.
Blockstream said the authorization key was not compromised, and SideSwap likewise said neither its systems nor its key had been compromised. SideSwap attributed the event to a bug in Elements, the software on which Liquid runs, that created the L-BTC used in the withdrawal. Neither Liquid nor Blockstream publicly described the underlying flaw.
On-chain messages and a pending restart
The parties communicated publicly through messages embedded in Bitcoin transactions. An early message said the group were white hats and asked to be contacted on-chain. The group requested that the flaw be fixed and all nodes patched before it would return funds. Blockstream replied with a signed message stating that its bridge nodes had been patched and that the funds could be returned safely.
A transaction confirmed at 15:31 UTC on September 7 sent 1,000 satoshis to the federation together with a PGP-encrypted on-chain message whose contents are not public. The 3,400 BTC transfer followed 38 minutes later. Blockstream said updated software had been deployed and federation members were preparing a coordinated restart.
Reserve and operational questions remain
The remaining 598.5 BTC was change from the same transaction rather than a separate payment. Blockstream and Liquid had not said publicly whether its retention was part of an agreement. Samson Mow, chief executive of JAN3 and a former Blockstream executive, said Blockstream remained in contact with the group. Ledger chief technology officer Charles Guillemet questioned the white-hat label, saying a negotiated payment could resemble extortion.
Blockstream’s status page still listed the incident as active, with public bridge nodes down, and did not state how much bitcoin backed L-BTC after the return. Mow advised users not to send bitcoin to Liquid peg-in addresses until a restart is confirmed. Blockstream said other Liquid-issued assets, including USDT and DePix, were unaffected. For businesses, the episode makes confirmed bridge status, reserve information and redemption availability essential checks before transferring assets into a sidechain.