Industry News

Hackers Return Most of $320M Stolen from Liquid Bitcoin Network, Keep $47M

Decrypt · 8 Sept 2026

Key Takeaway Businesses relying on blockchain bridges or sidechains should monitor official channels closely during incidents and avoid transacting with affected assets until operators confirm systems are fully patched and verified.

A security incident hit Blockstream's Liquid Network, a Bitcoin sidechain, after an attacker withdrew roughly 4,000 BTC (about $320 million) via SideSwap's peg-out service. The actors, calling themselves 'white hat hackers', demanded that Blockstream patch the underlying bug before they would return the funds, and Blockstream confirmed via a signed message that its bridge nodes had been patched.

Following that confirmation, the attackers returned 3,400 BTC (around $269 million), roughly 85% of the stolen funds, but retained approximately 598.5 BTC (about $47 million). Ledger CTO Charles Guillemet questioned the 'white hat' framing, arguing that keeping a portion of the funds looks more like extortion than ethical disclosure.

Liquid disabled its bridge nodes and asked exchanges to suspend deposits and withdrawals of L-BTC while it investigates. The network has not confirmed whether the remaining coins will be returned, how any shortfall in L-BTC backing will be covered, or when normal operations will resume.

Summarised by CISO AI from Decrypt. We link back to every original so you can read it yourself.