{"investigation":{"slug":"blockstream-liquid-network","entity_name":"Blockstream Liquid Network","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Liquid Network is a federated Bitcoin sidechain operated by Blockstream and a consortium of more than 80 exchanges and financial firms, launched in 2018 to enable confidential, faster settlement of bitcoin and issued assets. On September 6, 2026, an attacker exploited a software bug to mint roughly 4,000 unbacked L-BTC and withdraw an equivalent amount of real bitcoin (reported at approximately $319-320 million) from the federation's reserve wallet via member exchange SideSwap, in what multiple outlets called the largest crypto theft of 2026 to that point. The attacker, self-styling as a \"white hat,\" returned about 3,400 BTC after Blockstream patched the bug but kept roughly 598.5 BTC (about $47 million), a framing Blockstream and several security figures have publicly disputed as closer to extortion than a bug bounty; the network remained paused with an unresolved reserve shortfall as of the most recent reporting found.","sections":[{"content":"Liquid Network is a Bitcoin sidechain developed by Blockstream, a Bitcoin infrastructure company. According to Blockstream's October 10, 2018 launch announcement, the Liquid blockchain went live and was designed as an inter-exchange settlement network connecting exchanges, market makers, brokers and financial institutions, enabling faster, more confidential transfers of bitcoin (as L-BTC) and other \"Issued Assets\" such as tokenized fiat and attested commodities. The network launched with 23 member exchanges and firms including Bitfinex, BitMEX, Bitso, Korbit, OKCoin, Xapo and others. The Liquid Federation, as described in Blockstream's own support documentation, is a consortium of more than 80 Bitcoin-aligned businesses; a subset of 15 members (expandable under \"Dynamic Federation\" rules) operate tamper-resistant hardware security module (HSM) \"functionaries\" that take turns signing sidechain blocks and jointly control the multisignature wallet holding Bitcoin reserves backing L-BTC on a reportedly 1:1 basis. Members can also be added to a Peg-Out Authorization Key (PAK) list permitting them to process user requests to convert L-BTC back into BTC. This federated, HSM-based custody model — rather than a trust-minimized cryptographic bridge — is the structure through which the September 2026 incident occurred.","heading":"Background: Liquid Network and the Liquid Federation","sources":[{"url":"https://blockstream.com/press-releases/2018-10-10-blockstream-launches-the-liquid-network/","name":"Blockstream launch press release (2018)","type":"official","credibility":1},{"url":"https://help.blockstream.com/hc/en-us/articles/900003013143-What-is-the-Liquid-Federation","name":"Blockstream Help Center: What is the Liquid Federation?","type":"official","credibility":1}],"severity":"low"},{"content":"On September 6, 2026, an unidentified attacker exploited a bug in Elements, the open-source software underlying Liquid, to mint approximately 4,000 L-BTC that were not backed by any corresponding bitcoin deposit. According to on-chain analysis published by Bitquery, a single Liquid transaction at 13:53 UTC (block 4,050,336) created the unbacked tokens using an oversized, manipulated range proof; the resulting L-BTC was moved to SideSwap, a Liquid Federation member operating a peg-out (L-BTC-to-BTC conversion) service. At 14:06 UTC, SideSwap requested a peg-out of roughly 3,996 BTC, and at 14:28 UTC the federation's multisignature wallet — reportedly requiring 11-of-15 valid functionary signatures — paid out a transaction of about 4,019 BTC, the bulk of which was forwarded to the attacker's address. Multiple outlets, including TRM Labs and The Block, reported the stolen value at approximately $319-320 million, which several described as the largest crypto hack to that point in 2026. Blockstream and SideSwap both stated that no private keys, signing infrastructure, or the PAK authorization key itself were compromised; the fault lay in the validation logic that allowed invalid range proofs to be accepted as genuine. Liquid Network halted new block production and bridge-node activity, and exchanges were asked to suspend L-BTC deposits and withdrawals.","heading":"The September 6, 2026 exploit: scope and mechanism","sources":[{"url":"https://trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs: 2026's biggest hack to date — attackers drained $319 million from Liquid Network, then returned 85% of funds","type":"research","credibility":2},{"url":"https://bitquery.io/investigations/liquid-network-hack-4000-btc-op-return","name":"Bitquery investigation: Liquid Network hack, 4,000 BTC, OP_RETURN communications","type":"research","credibility":2},{"url":"https://theblock.co/news/defi/2026-09-07-liquid-network-attacker-says-they-will-return-most-of-4000-btc-after-bug-fix-413673","name":"The Block: Liquid Network attacker says they will return most of 4,000 BTC after bug fix","type":"news_article","credibility":2},{"url":"https://bitcoinmagazine.com/news/alleged-white-hat-hackers-withdraw-4000-bitcoin-from-blockstreams-liquid-network-federation-reserves","name":"Bitcoin Magazine: Alleged white-hat hackers withdraw 4,000 Bitcoin from Blockstream's Liquid Network federation reserves","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The precise root cause of the Elements bug has not been officially confirmed by Blockstream in detail, and independent analyses disagree on specifics. Bitquery's on-chain investigation inferred that the flaw involved a range-proof verification cache whose key was built by concatenating proof data, hidden amount, hidden asset and output script without length prefixes, allowing different inputs to collide and an unverified proof to be treated as valid; Bitquery identified a partial fix merged on September 2, 2026 and backported September 3, with a further hardening fix on September 8 and the release of Elements 23.3.4 on September 9. By contrast, Protos reported that it \"couldn't establish\" that this specific bug was the one exploited, pointing instead to a separate Elements commit from around September 1 whose message described a dynamic federation (\"dynafed\") header with a mismatched block height that \"could be accepted\" prior to the fix. Protos also reported that Bitcoin Core contributor Antoine Poinsot noted the mempool.space Liquid node rejected the block containing the fraudulent peg-out while Blockstream's own infrastructure accepted it, and that Jameson Lopp criticized the Liquid functionary codebase for having had no public commits since April 19, 2024. Given these conflicting technical accounts and the absence of a detailed public post-mortem from Blockstream at the time of this research, the specific mechanism should be treated as unconfirmed.","heading":"Disputed technical root cause: range-proof caching vs. dynafed validation","sources":[{"url":"https://bitquery.io/investigations/liquid-network-hack-4000-btc-op-return","name":"Bitquery investigation: Liquid Network hack, 4,000 BTC, OP_RETURN communications","type":"research","credibility":2},{"url":"https://protos.com/how-4000-btc-walked-out-of-blockstreams-liquid-network/","name":"Protos: How 4,000 BTC walked out of Blockstream's Liquid Network","type":"news_article","credibility":2}],"severity":"high"},{"content":"SideSwap, a Liquid Federation member that operates a peg-out service and holds a Peg-Out Authorization Key, stated that a customer sent it approximately 4,000 L-BTC, which it burned through a valid peg-out authorization before the federation paid out roughly 3,996 BTC to the customer's Bitcoin address. SideSwap said that neither its own systems nor its PAK had been compromised, and that Blockstream subsequently attributed the unbacked L-BTC to a bug in the Elements software rather than any fault on SideSwap's part. Following the withdrawal, Liquid paused block production and bridge nodes, and several exchanges suspended L-BTC deposits and withdrawals. According to The Block and TRM Labs, Liquid block production resumed around September 10, 2026, but peg-outs remained disabled as a precaution pending further security review and resolution of the reserve shortfall.","heading":"Role of SideSwap and the federation's response","sources":[{"url":"https://theblock.co/news/defi/2026-09-07-liquid-network-attacker-says-they-will-return-most-of-4000-btc-after-bug-fix-413673","name":"The Block: Liquid Network attacker says they will return most of 4,000 BTC after bug fix","type":"news_article","credibility":2},{"url":"https://trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs: 2026's biggest hack to date","type":"research","credibility":2}],"severity":"high"},{"content":"Shortly after the theft, the attacker embedded the message \"we are whitehats. contact us on chain\" in a Bitcoin OP_RETURN field and began negotiating with Blockstream, led by CEO Adam Back, through further on-chain OP_RETURN and PGP-encrypted messages, according to Bitquery's analysis and The Block. The attacker said it would return funds once the underlying bug was fixed; after Blockstream sent a PGP-signed message stating \"Bridge nodes are patched, safe to return the funds,\" the attacker returned approximately 3,400 BTC to the federation's peg wallet on September 7, 2026, while retaining roughly 598.5 BTC (reported at approximately $47 million). The attacker subsequently moved negotiations into plaintext on-chain messages and, according to Gizmodo and Decrypt, demanded that Blockstream pay a 10% \"bounty\" on top of the funds already kept, warning that L-BTC holders would otherwise absorb a loss equal to the retained 15% share. Blockstream and several prominent figures in the Bitcoin security community publicly rejected the white-hat framing: Ledger CTO Charles Guillemet called the arrangement \"straight extortion,\" Bitcoin Core contributor Greg Sanders (Spiral) likened it to \"robbing a fancy bank,\" and Bitcoin Magazine editor Shinobi argued that the public bounty demand put the attacker's conduct, in his words, \"dead to rights\" as extortion rather than responsible disclosure. These assessments are opinions from named individuals rather than adjudicated findings, and the attacker's true intent and identity remain unconfirmed.","heading":"Partial return of funds and disputed \"white hat\" claim","sources":[{"url":"https://bitquery.io/investigations/liquid-network-hack-4000-btc-op-return","name":"Bitquery investigation: Liquid Network hack, 4,000 BTC, OP_RETURN communications","type":"research","credibility":2},{"url":"https://decrypt.co/377723/liquid-hack-47m-blockstream-bargains-white-hat","name":"Decrypt: $47M Still Missing After Liquid Hack as Blockstream Bargains With 'White Hats'","type":"news_article","credibility":2},{"url":"https://gizmodo.com/white-hat-liquid-network-crypto-hackers-are-now-grandstanding-and-demanding-a-10-bounty-2000809413","name":"Gizmodo: White hat Liquid Network crypto hackers are now grandstanding and demanding a 10% bounty","type":"news_article","credibility":2},{"url":"https://therecord.media/liquid-network-blockstream-crypto-theft-hackers-keep-reward","name":"The Record: Liquid Network, Blockstream crypto theft — hackers keep reward","type":"news_article","credibility":2}],"severity":"high"},{"content":"On or around September 11, 2026, Blockstream publicly stated it would not pay the attacker's 10% bounty demand or otherwise negotiate for the return of the remaining roughly 598.5-600 BTC, reasoning that doing so would set a precedent encouraging future exploits across the industry. Instead, Blockstream said it would work with law enforcement agencies, exchanges, service providers and forensic specialists to trace the funds and pursue those responsible through legal channels. As of the most recent reporting identified in this research (mid-to-late September 2026), no arrests, seizures, or recovery of the remaining funds had been publicly reported.","heading":"Blockstream's refusal to pay a ransom","sources":[{"url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-liquid-414247","name":"The Block: 'Return the bitcoin' — Blockstream refuses ransom demand for remaining 600 BTC from Liquid exploit","type":"news_article","credibility":2},{"url":"https://thedefiant.io/news/security/blockstream-rejects-ransom-demand-after-liquid-bitcoin-exploit","name":"The Defiant: Blockstream rejects ransom demand after Liquid Bitcoin exploit","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Independent estimates found a reserve shortfall following the partial return of funds. TRM Labs estimated the federation's identified reserve address held about 3,597 BTC against roughly 4,200 L-BTC in circulation, implying approximately 86% backing — a figure TRM Labs itself characterized as an estimate rather than a full reserve-and-liability reconciliation. Protos separately cited Liquid.network's own dashboard as showing 4,205 L-BTC outstanding against as little as 197 BTC in reserves shortly after the incident (a figure that had not yet reflected the loss), while noting that the independent mempool.space Liquid audit flagged the unauthorized roughly 4,019 BTC withdrawal more promptly. Block production reportedly resumed around September 10, 2026, but peg-outs (L-BTC to BTC redemptions) remained suspended as of the most recent sources reviewed, with Blockstream stating redemptions would not resume until reserves fully backed outstanding L-BTC and security reviews were complete. No report found in this research, including searches specifically for October 2026 updates, confirmed full restoration of the 1:1 peg, resumption of peg-outs, or recovery of the retained 598.5 BTC.","heading":"Ongoing reserve shortfall and network status","sources":[{"url":"https://trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs: 2026's biggest hack to date","type":"research","credibility":2},{"url":"https://protos.com/how-4000-btc-walked-out-of-blockstreams-liquid-network/","name":"Protos: How 4,000 BTC walked out of Blockstream's Liquid Network","type":"news_article","credibility":2}],"severity":"high"},{"content":"The incident drew renewed scrutiny of the trust assumptions underlying federated Bitcoin sidechains. Unlike Bitcoin's base layer, Liquid relies on a federation of fewer than 100 vetted businesses operating HSM-based functionaries and a multisignature reserve wallet, rather than proof-of-work consensus, to secure both block production and the bitcoin backing L-BTC. Commentators cited by Protos, including Bitcoin developer Jameson Lopp, noted the Liquid functionary codebase had seen no public commits for roughly two years prior to the exploit, raising questions about ongoing security maintenance of federation-critical software. Yahoo Finance and other outlets framed the episode as exposing broader \"cracks\" in federated and custodial crypto infrastructure, given that a software validation bug — rather than a compromised private key — was sufficient to drain the vast majority of a nine-figure reserve in a single afternoon. These are characterizations by named commentators and journalists rather than a resolved technical consensus, and should be read as such.","heading":"Systemic risk: federated custody and sidechain security model","sources":[{"url":"https://protos.com/how-4000-btc-walked-out-of-blockstreams-liquid-network/","name":"Protos: How 4,000 BTC walked out of Blockstream's Liquid Network","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2018-09-27","event":"Liquid Network blockchain goes live.","source":"Blockstream press release","source_url":"https://blockstream.com/press-releases/2018-10-10-blockstream-launches-the-liquid-network/","date_evidence":"The Liquid blockchain went live on September 27, 2018, at 1:29 UTC."},{"date":"2018-10-10","event":"Blockstream publicly announces the launch of the Liquid Network with 23 founding member exchanges and firms.","source":"Blockstream press release","source_url":"https://blockstream.com/press-releases/2018-10-10-blockstream-launches-the-liquid-network/","date_evidence":"2018-10-10-blockstream-launches-the-liquid-network"},{"date":"2026-09","event":"Attacker mints approximately 4,000 unbacked L-BTC on the Liquid sidechain and, via SideSwap's peg-out service, the federation pays out roughly 4,000 BTC (about $319-320 million) to the attacker's address.","source":"Bitquery / TRM Labs","source_url":"https://trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","date_evidence":"At 13:53 UTC, Liquid block 4,050,336 contained a transaction with one input, three outputs, and a 58-sat fee.","date_original":"2026-09-06"},{"date":"2026-09","event":"Attacker leaves an on-chain OP_RETURN message claiming to be a \"white hat\" and inviting contact from Blockstream.","source":"Bitquery investigation","source_url":"https://bitquery.io/investigations/liquid-network-hack-4000-btc-op-return","date_evidence":"6 Sep 18:30 | Attacker | \"we are whitehats. contact us on chain\"","date_original":"2026-09-06"},{"date":"2026-09","event":"Attacker returns approximately 3,400 BTC to the federation's peg wallet after Blockstream confirms bridge nodes are patched, retaining about 598.5 BTC (approximately $47 million).","source":"Bitquery investigation / The Block","source_url":"https://theblock.co/news/defi/2026-09-07-liquid-network-attacker-says-they-will-return-most-of-4000-btc-after-bug-fix-413673","date_evidence":"7 Sep 16:09 | Attacker | Returned 3,400 BTC to the peg wallet and 598.4996 BTC to itself, in one 15-input transaction","date_original":"2026-09-07"},{"date":"2026-09","event":"Blockstream releases Elements 23.3.4 incorporating hardening fixes related to the exploited validation logic.","source":"Bitquery investigation","source_url":"https://bitquery.io/investigations/liquid-network-hack-4000-btc-op-return","date_evidence":"Elements 23.3.4 was released on 9 Sep at 03:14 UTC.","date_original":"2026-09-09"},{"date":"2026-09","event":"Attacker moves negotiations to plaintext on-chain messages and demands a 10% bounty from Blockstream; Blockstream and figures including Ledger CTO Charles Guillemet publicly dispute the \"white hat\" framing as extortion.","source":"Gizmodo / Decrypt","source_url":"https://gizmodo.com/white-hat-liquid-network-crypto-hackers-are-now-grandstanding-and-demanding-a-10-bounty-2000809413"},{"date":"2026-09-11","event":"Blockstream publicly refuses to pay a ransom/bounty for the remaining approximately 598-600 BTC and says it will pursue recovery through law enforcement and forensic specialists.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-liquid-414247","date_evidence":"2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-liquid-414247"},{"date":"2026-09","event":"Liquid block production reportedly resumes, but peg-outs (L-BTC to BTC redemptions) remain suspended pending resolution of an estimated reserve shortfall of roughly 14%.","source":"TRM Labs","source_url":"https://trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds"}],"sources_used":[{"url":"https://blockstream.com/press-releases/2018-10-10-blockstream-launches-the-liquid-network/","name":"Blockstream launch press release (2018)","type":"official","credibility":1},{"url":"https://help.blockstream.com/hc/en-us/articles/900003013143-What-is-the-Liquid-Federation","name":"Blockstream Help Center: What is the Liquid Federation?","type":"official","credibility":1},{"url":"https://trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs: 2026's biggest hack to date — attackers drained $319 million from Liquid Network, then returned 85% of funds","type":"research","credibility":2},{"url":"https://bitquery.io/investigations/liquid-network-hack-4000-btc-op-return","name":"Bitquery investigation: Liquid Network hack, 4,000 BTC, OP_RETURN communications","type":"research","credibility":2},{"url":"https://protos.com/how-4000-btc-walked-out-of-blockstreams-liquid-network/","name":"Protos: How 4,000 BTC walked out of Blockstream's Liquid Network","type":"news_article","credibility":2},{"url":"https://theblock.co/news/defi/2026-09-07-liquid-network-attacker-says-they-will-return-most-of-4000-btc-after-bug-fix-413673","name":"The Block: Liquid Network attacker says they will return most of 4,000 BTC after bug fix","type":"news_article","credibility":2},{"url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-liquid-414247","name":"The Block: 'Return the bitcoin' — Blockstream refuses ransom demand for remaining 600 BTC from Liquid exploit","type":"news_article","credibility":2},{"url":"https://thedefiant.io/news/security/blockstream-rejects-ransom-demand-after-liquid-bitcoin-exploit","name":"The Defiant: Blockstream rejects ransom demand after Liquid Bitcoin exploit","type":"news_article","credibility":2},{"url":"https://decrypt.co/377723/liquid-hack-47m-blockstream-bargains-white-hat","name":"Decrypt: $47M Still Missing After Liquid Hack as Blockstream Bargains With 'White Hats'","type":"news_article","credibility":2},{"url":"https://gizmodo.com/white-hat-liquid-network-crypto-hackers-are-now-grandstanding-and-demanding-a-10-bounty-2000809413","name":"Gizmodo: White hat Liquid Network crypto hackers are now grandstanding and demanding a 10% bounty","type":"news_article","credibility":2},{"url":"https://therecord.media/liquid-network-blockstream-crypto-theft-hackers-keep-reward","name":"The Record: Liquid Network, Blockstream crypto theft — hackers keep reward","type":"news_article","credibility":2},{"url":"https://bitcoinmagazine.com/news/alleged-white-hat-hackers-withdraw-4000-bitcoin-from-blockstreams-liquid-network-federation-reserves","name":"Bitcoin Magazine: Alleged white-hat hackers withdraw 4,000 Bitcoin from Blockstream's Liquid Network federation reserves","type":"news_article","credibility":2},{"url":"https://blockzeit.com/white-hats-face-backlash-from-47m-bill-in-liquid-network-exploit/","name":"Blockzeit: White hats face backlash from $47M bill in Liquid Network exploit","type":"news_article","credibility":3}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-11T12:14:37.588018+00:00","updated_at":"2026-10-27T00:23:59.542+00:00"},"source_quality":{"total":13,"tier1":0,"tier2":4,"tier3":0,"unrated":9},"follower_count":null,"content_updated_at":"2026-10-27T00:23:59.982Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":"2026-11-03T00:24:07.711Z"}