# Liquid Network Hack: $320M Bitcoin Negotiation Unfolds on Blockchain Hackers offer to return funds after vulnerability fix. - **Source:** [DailyCoin](https://brifing.si/source/3e9b0f85-cb2f-40ee-ba61-db9410cf0937) - **Published:** 2026-09-07 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/a814aaee-2275-4669-b94f-afb434ce3f2b ## The Liquid Network Hack On September 6, 2026, hackers withdrew approximately 4,000 BTC (worth $320 million) from Blockstream’s Liquid Network federation wallet. The exploit was attributed to a software bug in Elements, the underlying technology of Liquid. The hackers, claiming to be white-hat actors, communicated their intention to return most of the funds once the vulnerability was fixed. The incident left Liquid’s reserves severely depleted, with only 197 BTC remaining in the wallet. ## Impact on L-BTC Peg The hack caused Liquid’s native token, L-BTC, to lose its 1:1 peg with Bitcoin. With 4,000 BTC drained, L-BTC was backed by only 4.7% of the required reserves. This raised concerns about the token’s value once the network resumes operations. The collapse of the peg has left users uncertain about the future of their assets, as exchanges paused L-BTC deposits and withdrawals. ## Public Blockchain Negotiations The hackers and Blockstream engaged in public negotiations via messages embedded in Bitcoin transactions. The hackers demanded that the vulnerability be fixed and all nodes patched before returning the funds. Blockstream responded, confirming that bridge nodes were patched and it was safe to return the funds. This unusual negotiation method highlighted the transparency of blockchain technology. ## Partial Return of Funds On September 7, the hackers returned 3,400 BTC (85% of the stolen amount) to the Liquid Federation wallet. The remaining 598.5 BTC was sent back as change in the same transaction. Blockstream has not publicly confirmed whether this return was part of an agreement. The partial return alleviated some pressure but left questions about the fate of the remaining funds. ## Role of SideSwap The stolen BTC was withdrawn through SideSwap, an approved Liquid trading platform. SideSwap clarified that its systems and keys were not compromised. Instead, the exploit was due to a bug in Elements that allowed the creation of unbacked L-BTC, which was then redeemed for BTC. This highlighted a critical flaw in Liquid’s peg-out mechanism. ## Network Pause and Bridge Nodes Following the hack, Liquid paused its network by disabling bridge nodes, halting new transactions. Federation members worked to resolve the vulnerability and restore normal operations. The pause disrupted the network’s ecosystem, leaving users unable to access their assets. Exchanges were also instructed to suspend L-BTC deposits and withdrawals. ## White-Hat Claims The hackers identified themselves as white-hat actors, claiming their actions were intended to expose vulnerabilities. They emphasized their willingness to return most of the funds once the issue was resolved. However, their motives remain unclear, and the industry awaits further details on whether their actions were genuinely altruistic or opportunistic. ## Technical Vulnerability The exploit stemmed from a bug in Elements, Liquid’s underlying software, which allowed the creation of unbacked L-BTC. This L-BTC was then redeemed for BTC through the peg-out mechanism. Blockstream has not yet released a detailed technical post-mortem, leaving the exact nature of the vulnerability undisclosed. ## Market Reactions The hack caused significant uncertainty in the crypto market, particularly among Liquid Network users. The collapse of the L-BTC peg raised concerns about the stability of sidechain tokens. Analysts speculated on the potential long-term impact on Liquid’s reputation and the broader implications for Bitcoin sidechains. ## Industry Implications The Liquid Network hack underscores the risks associated with centralized components in decentralized systems. The incident highlights the need for robust security measures in sidechain designs. It also raises questions about the accountability of federation-operated mechanisms and their vulnerability to exploits. ## Future of Liquid Network The resolution of the hack will determine Liquid Network’s future. While the partial return of funds is a positive step, the network must address the underlying vulnerability to regain user trust. The incident serves as a reminder of the challenges in maintaining secure and reliable blockchain ecosystems. ## Conclusion The Liquid Network hack is a stark reminder of the vulnerabilities in blockchain systems, even those designed to enhance Bitcoin’s functionality. The public negotiation between hackers and Blockstream demonstrates the transparency of blockchain technology. However, the incident raises critical questions about security, trust, and the future of sidechain ecosystems. ## Sources covering this story - [DailyCoin — Liquid Network Hackers Negotiate $320M Bitcoin Return via Blockchain Messages](https://dailycoin.com/liquid-network-hack-320-million-bitcoin/) - [Bitcoin News — Liquid Network Hack: $320M Stolen, L-BTC Peg Collapses to 4.7%](https://news.bitcoin.com/security/blockstream-to-liquid-network-hacker-safe-to-return-the-funds/) - [The Hacker News — Liquid Hackers Return 3,400 Bitcoin After Exploiting Elements Bug](https://thehackernews.com/2026/09/liquid-hackers-return-3400-bitcoin.html) - [CryptoCurrency – Finance Magnates | Financial and business news — $320M Withdrawn from Liquid Network's Reserve, Threatening L-BTC Peg](https://www.financemagnates.com/cryptocurrency/purported-white-hats-pull-320m-from-liquid-reserve-putting-l-btc-peg-under-scrutiny/) - [Cointelegraph.com News — Liquid Network halts operations after $320M Bitcoin withdrawal by 'white hats'](https://cointelegraph.com/news/liquid-network-pauses-320m-bitcoin-withdrawal?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._