The attacker who withdrew ~4,000 BTC from Blockstream's Liquid Network federation wallet returns 3,400 BTC after Blockstream said its bridge nodes were patched

- The attacker who withdrew roughly 4,000 BTC from a Liquid Federation wallet has returned 3,400 BTC after Blockstream said its bridge nodes had been patched.

The Block 2026-09-07

Context & Ripple Effects

Liquid had already halted new transactions after the federation wallet withdrawal, making the bridge-node patch and partial return the first concrete steps toward containing the incident. The return leaves 600 BTC of the roughly 4,000 BTC withdrawal unrecovered.

Earlier crypto exploits have also involved partial voluntary returns, including the Poly Network asset return in 2021, but that precedent does not settle responsibility or recovery terms in the Liquid case.

First-order effects

Blockstream has recovered 3,400 BTC for the Liquid Federation wallet after patching its bridge nodes, reducing the immediate shortfall to 600 BTC.
The attacker still controls the unrecovered 600 BTC, so the patch does not by itself restore all assets removed from the federation wallet.

Second-order effects

For Liquid Federation participants, the immediate issue shifts from stopping the withdrawal to reconciling the remaining 600 BTC gap against the patched bridge-node setup.
The partial return makes Blockstream's explanation of the bridge-node fix central to confidence in any restoration of normal Liquid Network operations.

Third-order effects

If comparable bridge incidents continue to be resolved through emergency halts, patches and partial recoveries, federated Bitcoin systems will face stronger scrutiny over how concentrated custody and bridge security are governed.
The episode reinforces that a technical patch and an asset recovery are separate tests: infrastructure operators must demonstrate both exploit containment and clear allocation of residual losses.

The trend: Bitcoin-adjacent bridge and federation designs are being judged increasingly on their ability to contain exploits, recover assets and account for residual losses under stress.

Discussion

@p3b7_ Charles Guillemet on x
So, 3,400 BTC were refunded. The “white hats” still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking! Let's see what happens to these 600 BTC...
@grassfedbitcoin @grassfedbitcoin on x
It's *not* an inside job. Andy wasn't running a Ponzi Scheme and Blockstream absolutely did *not* pull off a fake hack, stealing their own money and giving it back to themselves minus the money they needed (~$50m or so) to keep the game of musical chairs going. It's totally a thi…
@adamsimecka Adam Simecka on x
Well, they found the bug that drained the Liquid Federation. It's not good. From what we can tell, Blockstream recently found a vulnerability from 2019. I am going to leave individual names out, because this is ultimately Blockstream's responsibility. They were actively patching …
@adamsimecka Adam Simecka on x
Confirmed. Liquid has received the majority of their bitcoin back. Now, they just have a $47M hole to fill. I assume that responsibility lies solely on Blockstream, as they were the ones that caused this vulnerability.
@thedesertlynx Joel Valenzuela on x
This is the most embarrassing moment in Bitcoin's modern history. 😭 Blockstream, the company headed by “cYpHeRpUnK LeGeNd
@jeremiahrogers Jeremiah on x
Yeah this whole thing is wild. The anger you are seeing directed at Adam Back is because he positioned himself as the “expert elder” and led a lot of the culture in crypto towards Bitcoin and away from other projects. Often with toxicity. A lot of that “wise elder
@financeguy74 Seán Murray on x
So 600 BTC from untouched 2010 addresses woke up the same time that a white hat hacker took a 600 BTC “bounty” from Liquid Network? Weird
@liquid_btc @liquid_btc on x
...What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others. Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals. Other Liquid asse…
@side_swap @side_swap on x
Statement on today's Liquid incident Today at 14:05 UTC a customer sent 4,000 L-BTC to the SideSwap peg-out service. Our service processed it like any other order: the L-BTC was burned on Liquid with a valid peg-out authorisation, and at 14:28 UTC the Liquid Federation paid 3,996…
@excellion Samson Mow on x
Everyone is actively working to resolve this and we'll share information as the situation develops. As a @Liquid_BTC wallet, Liquid functionality in @AquaBitcoin is impacted, but Bitcoin transactions will still work normally. These are difficult times but we'll pull through. 🙏
@intangiblecoins Alex Thorn on x
🚨💧 LIQUID HACKERS RETURN 85% OF STOLEN BITCOIN TO LIQUID FEDERATION after a lengthy conversation with blockstream via OP_RETURNs, in block 965,950 hackers sent 3400 BTC back to the original Liquid Federation address, apparently keeping 598.5 BTC (~$47m) for themselves (15%)
@excellion Samson Mow on x
The working theory is that the vulnerability is with Liquid's Confidential Transactions, but devs cannot confirm at this time. The vulnerability is a node level issue and is not related to PAKs or HSMs.
@excellion Samson Mow on x
Update: ...The network remains paused while Blockstream and Federation members make additional fixes and security improvements, resolve the chain split, and prepare for a safe restart. Liquid wallets and services will continue to be affected during this time. No user action is …
@side_swap @side_swap on x
Re today's Liquid incident: the ~4,000 BTC peg-out went through SideSwap's peg-out service on a customer order. As @Liquid_BTC confirmed, our PAK was not compromised. The L-BTC came from an Elements bug, not from any SideSwap system. Peg-in/out paused while Liquid is. Updates her…
@excellion Samson Mow on x
The discussion between @Blockstream and the white-hat hacker (WHH) regarding the ~4000 BTC from @Liquid_BTC is happening in public. It seems to be their preference over email. As it's hard to follow the chain of messages in OP_RETURN, here's a summary with links. 11:30 AM PDT - W…
@intangiblecoins Alex Thorn on x
full dialog between blockstream and the hackers
@_miguelmedeiros Miguel Medeiros on x
IT'S HAPPENING. The Liquid attacker just broadcast the return: 3,400 BTC to the federation address. Kept 598.5 BTC for himself. About 15%. “Sending most back” was literal. After 11 rounds of OP_RETURN drama, PGP signatures and Electrum tutorials, the whitehat bounty was appa…
@moo9000 Mikko Ohtamaa on x
600 BTC is a fair bounty to deal with Bitcoin maxis
@mattjay Matt Johansen on x
Name your price bug bounty
@_miguelmedeiros Miguel Medeiros on x
The return tx is RBF-enabled. The attacker could've bumped the fee himself for a few thousand sats. Instead someone paid the https://mempool.space/ accelerator, the tool you use when you can't sign the tx. Blockstream really didn't want that RBF window open with 3,400 BTC on the …
@truthcoin Paul Sztorc on x
A thread about “Liquid” — one of Bitcoin's worst ideas ever It has just been drained of 4000 of its BTC https://x.com/...
@intcyberdigest @intcyberdigest on x
‼️ Self-proclaimed whitehat hackers used a vulnerability to drain Liquid Network of 4000 BTC ($320M USD) yesterday. Just now they've returned 3400 BTC and kept 600 BTC ($47M) as a ‘bug bounty’. They've also ‘responsibly’ disclosed the vulnerability in a PGP-encrypted message.
@k_firsov Kirill Firsov on x
Whoever did this, don't call yourself a white hat. You're just a thief with a PR strategy. Our team at @FearsOff recently found a huge vulnerability in one of the top crypto projects. We could have moved millions. We didn't. We sent a ~$100 proof transaction and got it fixed. Tha…
@_miguelmedeiros Miguel Medeiros on x
Round 15. Blockstream replies again. PGP-signed, encrypted, confirmed in block 965962. That's four encrypted messages back and forth since the 3,400 BTC return. The attacker still holds 598.5 BTC. The conversation isn't over. The telenovela continues. 🍿👀 https://mempool.space/...
@_miguelmedeiros Miguel Medeiros on x
Round 12. Ten minutes after returning 3,400 BTC, the attacker sends Blockstream another encrypted OP_RETURN message. Still holding 598.5 BTC. The finale had a post-credits scene. 🍿👀 https://mempool.space/...
@pledditor @pledditor on x
A 600 BTC shortfall in reserves is still a lot of money, about ~$48m. A relaunch + bitfinex style haircut + shitcoin may work, but it would be pretty awkward for Adam Back to launch an altcoin. The entire selling point of Liquid was that it operated without a shitcoin
@watcherguru @watcherguru on x
JUST IN: 4,000 Bitcoin worth $320 million withdrawn following Liquid Network hack. The hacker is now communicating with network maintainers through on-chain Bitcoin transactions & intends to return the $BTC after the vulnerability is fixed.
@_miguelmedeiros Miguel Medeiros on x
CONFIRMED. Block 965950, mined by Foundry. 3,400 BTC back in the Liquid federation wallet. Attacker keeps 598.5 BTC. 27 hours from the fork to the return. 11 rounds of OP_RETURN, PGP signatures, an Electrum tutorial and a https://mempool.space/ accelerator. All settled on-chain, …
@marshallhayner Marshall Hayner on x
The entire narrative changes with @BitcoinVM_ connected to @MetalBlockchain, bridging is handled via warp messaging, secured by Snowman, direct to credit unions, banks and tradfi blockchains, no middleman.
@csuwildcat @csuwildcat on x
One interesting thing I learned from the Liquid hacker situation: many people aren't familiar with how per se crimes work. Folks seem to think that b/c Blockstream and the hacker may have had an agreement, it mitigates the crimes. That's false; per se crimes are locked in when th…
@muneeb @muneeb on x
Thoughts on the Liquid whitehat incident: Background: - Liquid is a Bitcoin L2/sidechain, launched by Blockstream in 2018. 4,000 BTC from their bridge was taken by a whitehat yesterday (and then mostly returned). - You can think of the Liquid network as running a fork of Bitcoin …
@csuwildcat @csuwildcat on x
The clearly-not-whitehat hacker kept almost 600 of the 4000 bitcoin they stole. Fun fact: engaging in a random exchange creates a cascade of new, even more serious criminal charges than if the hacker just kept it all, and law enforcement pursues it just as aggressively regardless
@jseyff James Seyffart on x
600 BTC is quite the tip hahaha. I have no idea what would be a standard acceptable bounty though? Still ... cold card victims would probably gladly give up 15% of their BTC to get back the other 85%. Doubt there'd even be any questions 🤷🏼‍♂️
@_miguelmedeiros Miguel Medeiros on x
Round 13. Blockstream replies to the attacker's post-return message. PGP-signed, encrypted, and short. About one sentence worth of ciphertext. 3,400 BTC returned, 598.5 BTC still with the attacker, and the two sides are now exchanging one-liners we can't read. Looks like the term…
@hodlmagoo Magoo PhD on x
Then worst thing the Liquid hacker did wasn't even stealing 4000 Bitcoin, it was spamming the chain with OP_RETURN messages.
@richardheartwin Richard Heart on x
.@adam3us called me a “scammer and con-artist.
@stevenroose3 Steven Roose on x
Did Blockstream offer them the 600 BTC voluntarily? Cuz if they bargained for it, that's definitely not white hat behavior. That's just a plain old ransom with negotiation.
@_miguelmedeiros Miguel Medeiros on x
The Liquid attacker is now doing Blockstream's release management. 🤣 “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.” Stole 3,998 BTC and won…
@mempool @mempool on x
our real-time audit of the https://liquid.network/ federation holdings shows an unauthorized -4019 BTC withdrawal
@darkwebinformer @darkwebinformer on x
🚨‼️ Liquid Network was drained of approximately 4,000 BTC, worth around $320 million, over the past several hours. The hackers left the following on-chain message: “we are whitehats. contact us on chain” Blockstream responded on-chain with:
@britishhodl @britishhodl on x
4000 Bitcoin have been STOLEN from the Liquid Network by “white hat” Bitcoin hackers. $322 Million. People are working (aka begging) to get Bitcoin back.
@mrsaneapps MrSane on x
@Liquid_BTC @Blockstream BTC is dead unless it finds a way to securely scale and be private. Anyone refusing to see this is just blind at this point.
@bitcoinmagazine @bitcoinmagazine on x
JUST IN: Hackers have stolen ~4,000 Bitcoin worth $320 million from the Liquid Network 🚨 The hackers claim to be white hat hackers, and said to “contact us on chain” 👀
@alanbwt Alan on x
Only the paranoid survive.
@tomerstrolight Tomer Strolight on x
@Liquid_BTC ... This chain can be rolled back, right? Right?
@brt2412 @brt2412 on x
@Liquid_BTC @Blockstream Another zero hash rate network bites the dust. Good riddance, should've used real BTC.
@peruvian_bull Roberto Rios on x
It's happening again All these hacks on Bitcoin products within a month, what is going on?
@cryptowendyo Wendy O on x
Meanwhile on Bitcoin... Sad to see.
@satoshinagonna @satoshinagonna on x
@Liquid_BTC @Blockstream If it was “whitehat” then they could have used one BTC to show a vulnerability, not cleaned the network out. No bueno...
@stokr_io @stokr_io on x
We are aware of the security incident affecting the Liquid Network's bitcoin peg. Digital securities issued through STOKR on Liquid are not impacted. They are issued as AMP assets, independent of L-BTC, and Liquid has confirmed that RWAs are unaffected by the incident. (1/2)
@donaldevine @donaldevine on x
@Liquid_BTC @Blockstream Live by the sidechain, die by the sidechain.
@bitcoinisaiah @bitcoinisaiah on x
@Liquid_BTC @Blockstream How does an attacker drain almost all the funds on a network that's supposed to be secured by a 11-15 multisig 🤔 Make it make sense.
@nod7r @nod7r on x
@Liquid_BTC @Blockstream Can we somehow blame Coldcard devs?
@kepleronchain Kepler on x
@Liquid_BTC @Blockstream please for the love of god make them actual whitehats. we've had enough good momentum in crypto lately, we don't need a market-wide nuke right now.
r/Bitcoin r on reddit
Liquid Network appears to have been stalled for 5 hours and had 4,000 BTC moved without authorization.

Chronicles