Crypto

Liquid Network Hack: White Hats Return 3,400 Bitcoin, But Keep $47 Million

co-written by newsrooms.ai08. September 2026, 10:29

The attack on Liquid, the Bitcoin sidechain operated by Blockstream, has been settled for now, and the settlement came at a steep price. The group that withdrew roughly 4,000 BTC from the network’s federation wallet on Sunday sent 3,400 BTC back on Monday. The remaining 598.5 BTC stayed at the attackers’ address as a self declared finder’s fee. At a bitcoin price of around $78,500, that comes to about $47 million, or roughly 40 million euros. It is exactly 15 percent of the amount originally withdrawn.

Trending Topics has already reported on the incident itself: 4,000 L-BTC were redeemed through the peg-out path of the service provider SideSwap, after which the Liquid Federation paid out nearly 3,996 real bitcoin to a Bitcoin address. According to the network, SideSwap’s peg-out authorization key was not compromised. SideSwap says the root cause was a bug in Elements, the software Liquid is built on. The network was paused, and exchanges halted L-BTC deposits and withdrawals.

Negotiating Inside the Blockchain

The remarkable part is how the two sides talked to each other: through messages written directly into Bitcoin blocks. The group, which describes itself as white hats, first surfaced with a “contact us on chain” in the OP_RETURN field of a transaction, sent from the address holding the 4,000 BTC. An address linked to Blockstream replied by pointing to security@blockstream.com. From there, both sides moved to encrypted and PGP signed messages whose signatures can be checked against Blockstream’s published security key.

The attackers set out their condition like this: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.” Hours later, Blockstream confirmed in the clear: “Bridge nodes are patched, safe to return the funds.” Shortly afterwards the 3,400 BTC landed back at the federation’s peg address, with the rest going back to the group’s address as change.

What happened next points to a dispute. As Bitcoin Magazine documented, several encrypted messages followed from the Blockstream address, then another exchange, and finally the white hats wrote a sad face emoji into the blockchain. The contents of the encrypted messages are unknown, and Blockstream has stayed publicly silent on them so far. The sequence suggests an attempt to renegotiate the size of the finder’s fee that went nowhere.

Fifteen Percent Sits at the High End

After large exploits, the crypto industry has settled into a practice of informal bounties that let protocols buy back the bulk of their funds instead of relying on law enforcement. Typical rates run from the low single digits into the low double digits in percentage terms, often with an additional cap. The 15 percent kept here sits above that range, and the absolute figure is the more unusual part: no bug bounty program in the industry pays out $47 million. On top of that, there was no prior agreement in place, so the amount was set unilaterally.

Legally, the matter is far from closed for the group. Anyone who moves funds without consent and keeps a share of them is in criminal territory, whatever label they choose for themselves. The Block simply calls the party an attacker in its coverage.

For Liquid, a reputational problem remains alongside the financial damage. The sidechain is run by a consortium of exchanges and financial service providers and positions itself as institutional infrastructure for Bitcoin. The fact that a flaw in Elements allowed L-BTC to be issued without backing, and that the federation then paid it out in real bitcoin, hits precisely the point where the model asks users to extend trust. Whether and when the network will be fully unpaused was still open at last word.