Industry News

Liquid Network Attackers Return 85% of Stolen $320M Bitcoin Haul

Crypto Daily · 8 Sept 2026

Key Takeaway Even when stolen funds are partially recovered, businesses relying on third-party platforms should confirm vendors have patched known vulnerabilities before assuming their exposure is resolved.

The actors behind the Liquid Network exploit returned 3,400 BTC to the Liquid Federation wallet on September 7, recovering about 85% of the bitcoin taken during the original incident. The transaction was confirmed on-chain in Bitcoin block 965950, providing verifiable proof of the return.

The return followed a PGP-signed, on-chain message from Blockstream confirming its bridge nodes had been patched and that it was safe for the funds to be sent back. That message was recorded earlier the same day in block 965910. The original exploit had removed approximately 4,000 BTC, worth about $320 million at the time, and was linked to a vulnerability in Elements software rather than any compromise of Liquid's peg-out authorisation key.

Despite the large return, roughly 598.5 BTC (worth about $47 million) remains in the attackers' address, meaning the incident is not fully resolved. The available on-chain records confirm the timing of the patch notice and the subsequent transfer, but not the terms or negotiation behind the recovery.

Summarised by CISO AI from Crypto Daily. We link back to every original so you can read it yourself.