Liquid Network Sidechain Hackers Return Most Stolen Bitcoin, Keep Nearly 600 BTC

The actors behind a security incident on Liquid Network, the Blockstream-operated Bitcoin sidechain, have returned 3,400 BTC to the network's federation address, according to a September 7, 2026 incident summary from Bitcoin.com News. The attackers are reported to be retaining roughly 598.5 BTC, and the network remains paused while the terms governing the withheld funds are unconfirmed.

According to the report, the return came after Blockstream said its bridge nodes had been patched, meaning the funds were sent back once a fix was in place rather than before. This mirrors a previous episode involving Liquid in which a self-described white hat pledged to return funds after a vulnerability was fixed, though that status is contested and no published agreement confirms the retained amount as an authorised bounty. Readers should note this incident involves the Liquid Network sidechain, a separate system from the Japan-based Liquid exchange that was hacked in 2021.

Details such as the specific on-chain transactions could not be independently verified at the time of the report, so figures remain attributed to the original source pending further confirmation. The incident underscores how even well-established blockchain infrastructure can be targeted, and that recovery of stolen funds is not guaranteed or fully transparent.

Key Takeaway: Businesses relying on third-party blockchain or payment infrastructure should monitor vendor security advisories closely and have contingency plans for service pauses following a security incident.