• The exploit stemmed from a bug in Elements, Liquid's open-source codebase — Blockstream and SideSwap both said the federation's private keys and SideSwap's Peg-out Authorization Key were not compromised.
• Attackers drained roughly 4,000 BTC (~95% of the federation's reserve) on September 6, 2026, then returned 3,400 BTC (~$268 million) after Blockstream confirmed a patch via on-chain message.
• 598.5 BTC (~$47 million) remains outstanding, leaving L-BTC undercollateralized against its 1:1 bitcoin backing until the shortfall is closed.
• Bitfinex and the Aqua wallet suspended L-BTC deposits and withdrawals, and Blockstream disabled bridge nodes network-wide to freeze the peg-out system.
• No formal bounty agreement has been confirmed; CertiK flagged the retained 598.5 BTC as a possible reward, not a settled deal.

Blockstream's Liquid Network has recovered most of the roughly 4,000 bitcoin — about $320 million — that an attacker withdrew from its federation reserve on September 6, 2026, by exploiting a software bug rather than stealing a private key. Self-described "whitehats" returned 3,400 BTC (about $268 million) on September 7 after Blockstream confirmed the underlying flaw in its Elements codebase was patched, according to CoinDesk and CryptoTimes. But 598.5 BTC (roughly $47 million) remains outstanding, leaving L-BTC's 1:1 bitcoin backing unresolved and Bitfinex and the Aqua wallet still blocking L-BTC deposits and withdrawals.

How the exploit worked

Attackers withdrew roughly 4,000 BTC — about $320 million at the time — from the Bitcoin reserve backing Blockstream's Liquid Network sidechain on September 6, 2026, according to CoinDesk. The exploit traced to a software bug in Elements, the open-source codebase Liquid runs on, executed through a peg-out via SideSwap around 14:05 UTC. Blockstream and SideSwap both said the attack did not involve a compromise of the federation's private keys or SideSwap's Peg-out Authorization Key — the flaw let the attacker mint unbacked L-BTC and redeem it for real bitcoin, per CoinDesk and CryptoTimes.

The whitehat return

The people behind the withdrawal identified themselves as 'whitehats' and negotiated with Blockstream entirely through messages posted on the Bitcoin blockchain, CoinDesk reported. Blockstream confirmed a patch at 09:19:46 UTC on September 7 with the on-chain message 'Bridge nodes are patched, safe to return the funds'; the attackers then returned 3,400 BTC (about $268 million) but kept 598.5 BTC (roughly $47 million), according to CryptoTimes. Blockchain-security firm CertiK flagged the retained sum as a possible bounty, though neither party has confirmed a formal reward agreement.

Why the shortfall matters for the peg

L-BTC is designed to trade 1:1 against bitcoin because each token is supposed to be backed by an equivalent amount of BTC held in Liquid's federation reserve. With 598.5 BTC still missing, that backing is short by roughly $47 million, and Coinpedia reported the deficit risks pushing L-BTC to trade at a discount to bitcoin if it isn't closed — a dynamic that could trigger capital flight from the token. Bitfinex and the Aqua wallet have already suspended L-BTC deposits and withdrawals while the shortfall persists.

The infrastructure read

This is a code-integrity failure, not a custody-key theft, which is the more instructive distinction for anyone assessing federated Bitcoin sidechains and similar wrapped-asset bridges. Liquid's federation model is built to resist key compromise, but a bug in the shared Elements software let an outsider print claims on reserves the keys never had to move. Blockstream's response — disabling bridge nodes to freeze the entire peg-out system — shows the containment tool available to a federated design is blunt, and it stopped the bleeding only after roughly 95% of the reserve was already gone.