Liquid Network has resumed block production and on-network transactions, but peg-outs remain disabled while the final recovery phase continues. Separately, Blockstream says it will not pay a ransom tied to the 598.5 BTC that remains outstanding.
The status changed materially on September 10, when Liquid Network announced that transactions had resumed. On September 11, Blockstream rejected the demand for payment, saying the unauthorized taking and continued withholding of the bitcoin was theft rather than white-hat activity.
The network is not yet fully back to normal. Peg-outs remain closed as a precaution, 598.5 BTC has not been returned, and the final reserve recovery process is still underway. The incident affects Liquid's federation-based infrastructure; it does not mean Bitcoin's base layer was hacked.
Latest Update — September 11, 2026
Liquid said block production had resumed, functionary nodes were signing and validating blocks, and transactions were again being processed. However, peg-outs remain disabled while internal and external teams continue testing, code scanning, and network monitoring. Liquid said users do not need to take proactive steps, while node operators should update to Elements v23.3.4.
Blockstream said it would not pay for the return of the remaining bitcoin and would pursue lawful recovery efforts with law enforcement, exchanges, service providers, and forensic specialists if the funds are not returned. The dispute concerns approximately 598.5 BTC still controlled by the actors after 3,400 BTC was sent back on September 7. Reporting on the continuing negotiations said the actors had demanded a 10% bounty.
User status: Liquid transfers have resumed, but users still cannot peg L-BTC out to Bitcoin. Anyone receiving unsolicited recovery instructions should rely only on official Liquid and Blockstream channels and should never disclose seed phrases, private keys, or PINs.
Earlier Update: 3,400 BTC Returned
Update — September 7, 2026: The actors returned 3,400 BTC to the Liquid Federation wallet after Blockstream sent a signed on-chain message stating that its bridge nodes had been patched and that the funds were safe to return. The repayment recovered roughly 85% of the bitcoin withdrawn during the incident, according to on-chain transaction data reported by The Block.
Approximately 598.5 BTC, worth about $47 million at the time of the update, remained in the withdrawal-linked address. No publicly disclosed agreement has established that the retained amount is an authorized bounty, and the actors' white-hat claim therefore remains unverified. At that stage, Liquid had not announced when network activity would resume.
Key Findings
- Liquid resumed block production and on-network transactions on September 10, but peg-outs remain disabled.
- The actors returned 3,400 BTC, while approximately 598.5 BTC remains outstanding.
- Blockstream rejected a payment demand and said the continued withholding of the bitcoin is theft, not white-hat activity.
- The final reserve recovery and technical response remain ongoing; Bitcoin's base layer was not compromised.
What Happened at Liquid Network
Liquid Network said on X that individuals it described as "purported white-hat hackers" withdrew around 4,000 BTC from the Liquid Federation wallet. Reuters reported that the withdrawal represented about $320 million and that Liquid had halted new transactions after the incident.
Official source: Liquid Network’s incident statement on X.
According to Reuters, Liquid said the funds were withdrawn via SideSwap, a settlement platform permitted to handle withdrawals from the network, while the key used in the process was not compromised. That detail is important because it suggests the incident may not fit the standard pattern of a stolen private key or compromised signing credential.
CoinDesk, citing technical details around the incident, reported that the issue was connected to a possible software bug in Elements, the codebase underlying Liquid, rather than a straightforward key compromise. That remains a developing technical question, and users should avoid treating early explanations as final until Liquid and Blockstream publish a complete postmortem.
Why This Is Not a Bitcoin Mainnet Hack
Liquid is built around a sidechain model. In its own documentation, Liquid describes itself as an open-source Bitcoin sidechain and layer-2 solution that lets users move Bitcoin between Bitcoin and Liquid through a two-way peg.
That means BTC can be locked on Bitcoin while an equivalent representation, L-BTC, circulates on Liquid. The security model is therefore different from Bitcoin's proof-of-work base layer. Liquid relies on a federation structure for block signing and custody functions, while Bitcoin mainnet continues to be secured by its own decentralized mining network.
For readers, the practical takeaway is simple: this is a serious Liquid infrastructure incident, not evidence that Bitcoin itself stopped working or that Bitcoin balances on the base chain were broadly compromised.
Why the Federation Wallet Matters
Liquid's federation wallet is central to the network's peg model because it backs Bitcoin represented inside the Liquid ecosystem. Blockstream describes Liquid as a Bitcoin layer-2 for digital asset issuance, settlement, and confidential transactions, with the network positioned for Bitcoin-based financial infrastructure.
When most of the BTC in that wallet leaves unexpectedly, the issue becomes more than a normal transaction anomaly. It raises urgent questions about L-BTC backing, wallet operations, federation coordination, bridge safety, user access, and the conditions required before Liquid can safely restart new activity.
The initial halt served as a containment measure while federation members investigated the withdrawal path and deployed fixes. Transactions have since resumed, but the continuing peg-out restriction shows that reserve recovery and operational safeguards are not yet complete. For comparison, TCP’s Cronos rollback analysis examines a different emergency response in which validators replaced nearly two hours of chain history to recover protocol funds.
What Users Should Watch Now
Users with Liquid wallets, L-BTC balances, or assets issued on Liquid should monitor only official Liquid, Blockstream, wallet-provider, and exchange communications. On-network transactions have resumed, but users should watch for an official peg-out reopening notice, the disposition of the remaining 598.5 BTC, and any final technical postmortem.
Until those details are confirmed, users should be careful with unsupported recovery claims, fake support messages, and social-media accounts pretending to represent Liquid, SideSwap, Blockstream, or exchanges. Security incidents often create a second wave of phishing attempts aimed at affected users.
For exchanges and institutions, the incident will likely prompt a review of sidechain custody assumptions, federation controls, peg-out authorization processes, and monitoring systems around large reserve movements.
What Remains Unclear
Several key questions remain unresolved. Although 3,400 BTC has been returned and on-network transactions have resumed, approximately 598.5 BTC remains in the withdrawal-linked address. Liquid has not announced when peg-outs will reopen, and the timing and outcome of the final reserve recovery remain uncertain.
The "white-hat" framing also requires precise attribution. The actors used that label, but Blockstream now explicitly rejects it and describes the continued withholding of funds as theft. The remaining bitcoin has not been returned, and no publicly confirmed bounty agreement authorizes the actors to keep it.
The Bottom Line
This remains a significant Bitcoin-infrastructure security incident because it combines a large BTC movement, a partially restored sidechain, and continuing restrictions on users who need to peg out. The correct framing is not "Bitcoin was hacked." Liquid's federation-wallet and sidechain infrastructure suffered the incident, while Bitcoin mainnet continued operating.
The return of 3,400 BTC and the resumption of transactions materially improve the operational picture, but they do not close the incident. Peg-outs remain disabled, 598.5 BTC is still outstanding, and Blockstream says it will pursue recovery rather than pay the demand. Liquid should not be described as fully back to normal until the peg-out path and reserve recovery are complete.
Responses (0 )