Liquid Network Exploit: What Happened to the Reported $320 Million in Bitcoin

Attackers drained roughly 4,000 BTC from the federation wallet of the Liquid Network on September 6, 2026, a loss valued in press coverage at between about $319 million and $320 million. Liquid — a Bitcoin sidechain operated by Blockstream — halted new transactions shortly after, and most of the withdrawn bitcoin, roughly 3,400 BTC, was reported returned within a day of the exploit.

Bloomberg and Yahoo Finance, citing Liquid Network operators, reported that roughly 4,000 of the 4,200 BTC held in the network's main federation wallet were drained, valuing the loss at about $320 million. Blockchain analytics firm TRM Labs put the figure at approximately $319 million and called it 2026's biggest hack to that date. Shattered, a security-research publication, reported that the wallet's reserves fell from more than 4,200 BTC to around 197 BTC after the withdrawal. The operators told Bloomberg the perpetrators appeared to be self-described "white hat" hackers — a characterization made by the attackers themselves and relayed by news outlets, not independently confirmed.

TRM Labs reported that roughly 85% of the drained funds — about $272 million — had been returned as of September 8, leaving approximately $47 million missing at that point. Cryptonomist and the security-incident tracker SlowMist give consistent figures: about 3,400 BTC returned after the underlying software vulnerability was patched, with the remaining party keeping roughly 598 BTC, about $47 million, which they characterized as a self-declared bounty. As of September 8, Cryptonomist reported Liquid Network was still paused, with L-BTC activity suspended.

TRM Labs attributed the exploit to a bug in Liquid's validator software that allowed the creation of unbacked synthetic bitcoin tokens (L-BTC). SlowMist's incident log is more specific: an Elements range-proof verification cache bug let the actor create roughly 4,000 unbacked L-BTC, which were then moved out through SideSwap's standard peg-out path — the normal route for converting sidechain tokens back into real BTC. Shattered describes the same withdrawal mechanism as exploitation of the SideSwap Peg-out Authorization Key process. All of these technical accounts come from third-party incident trackers and security researchers, not from a public post-mortem by Blockstream, and should be read as incident-response reporting pending an official technical writeup.

Liquid Network is a sidechain linked to Bitcoin, not Bitcoin's base layer. It runs on a federation wallet that holds BTC as backing for the L-BTC tokens used on the sidechain. Because the reported flaw sat in Liquid's own validator or range-proof code, the damage was confined to assets and transactions on the sidechain rather than Bitcoin's core protocol. Shattered states explicitly that Bitcoin's base-layer protocol remained unaffected by the incident.

None of the sources reviewed identify specific exchange outages, withdrawal freezes, or individual user losses beyond the network-level halt described above. Account-specific status for L-BTC holdings or Liquid-connected services sits with the relevant exchange or wallet provider.