# Liquid Network exploit and fund recovery

> Live situation record from CLSTR: https://clstr.news/situations/liquid-network-bitcoin-exploit-and-fund-recovery
> Updated: 2026-09-10T20:57:58.000Z. Sources: 71. Developments: 3.

The Liquid Network, a Bitcoin sidechain developed by Blockstream, suffered a major security exploit on September 6, 2026, caused by a software bug in its underlying Elements technology. A vulnerability in range proof verification caching allowed for the creation of approximately 4,000 unbacked L-BTC tokens, which were used to withdraw roughly 4,000 BTC (valued at approximately $320 million) from the federation wallet via the peg-out mechanism.

Following the application of a security patch demanded by the attackers—who identified as ‘whitehats’—3,400 BTC was returned to the Liquid Federation wallet. Blockstream confirmed that core multisignature keys were not compromised and the issue was strictly a software verification failure. Approximately 598.5 BTC, valued at roughly $47 million, remains outstanding as negotiations continue.

As of September 10, 2026, the Liquid Network has resumed block production after functionary nodes resumed signing and validating blocks following necessary software updates. However, the network is currently operating “without transactions” to allow developers to monitor stability. Transactions and BTC peg operations, including the ability to move funds between Bitcoin and Liquid or utilize Peg-out Authorization Keys (PAKs), remain suspended.

Negotiations between the attackers and Blockstream have shifted from encrypted communications to public plaintext messages. The attackers are reportedly demanding a 10% bug bounty to be paid from Blockstream’s own funds in exchange for the remaining assets. Blockstream CEO Adam Back has stated that the company will compensate for the damages if necessary, while continuing to communicate via encrypted, PGP-signed notes. Liquid has not yet provided a specific date for the full reopening of transaction and bridge systems as work continues to restore the reserves supporting L-BTC.

## Claims

- The Liquid Network suffered an exploit resulting in the theft of approximately 4,000 Bitcoin. (corroborated by 8 sources)
- Blockstream patched the software vulnerability and confirmed the recovery of 3,400 Bitcoin. (corroborated by 6 sources)
- Approximately 598.5 Bitcoin remains outstanding following the return of 3,400 Bitcoin. (corroborated by 5 sources)
- The exploit was caused by a software bug in the Elements codebase related to range proof verification caching. (corroborated by 4 sources)
- The attackers identified themselves as white-hat hackers and negotiated via on-chain messages. (corroborated by 4 sources)
- The attackers used SideSwap’s peg-out authorization to convert unbacked L-BTC into real Bitcoin. (corroborated by 3 sources)
- The return of funds occurred after Blockstream confirmed that bridge nodes had been patched. (corroborated by 2 sources)
- The core multisignature keys securing the federation wallet were not compromised during the attack. (corroborated by 2 sources)

## Timeline

### 2026-09-10: Liquid Network resumes block production after $320M Bitcoin exploit

Liquid Network has resumed block production following a $320M Bitcoin exploit, though transactions and peg operations remain suspended while developers monitor for stability and negotiate with attackers.

12 sources. https://clstr.news/cluster/liquid-network-resumes-block-production-after-320m-bitcoin-withdrawal

### 2026-09-08: Liquid Network exploit results in theft of 4,000 Bitcoin

Attackers exploited a software bug in the Liquid Network to drain 4,000 Bitcoin. After Blockstream patched the vulnerability, the hackers returned 3,400 BTC, leaving approximately 598 BTC outstanding.

12 sources. https://clstr.news/cluster/blockstream-negotiates-recovery-of-47m-after-liquid-network-exploit

### 2026-09-06: Liquid Network recovers 85% of $320M Bitcoin stolen in exploit

Liquid Network recovered 85% of 4,000 BTC ($270M) stolen in a software bug exploit after negotiating with self-described white-hat hackers. Approximately 600 BTC remains outstanding.

59 sources. https://clstr.news/cluster/liquid-network-loses-nearly-4000-btc-in-massive-peg-out

---
Cite as: Liquid Network exploit and fund recovery. CLSTR, https://clstr.news/situations/liquid-network-bitcoin-exploit-and-fund-recovery