On September 7, 2026, the Liquid Network, a prominent Bitcoin sidechain, experienced a significant development in an ongoing security crisis. Following a massive drain of its reserves, the federation wallet governing the network received a return of 3,400 BTC. This transaction marks a pivotal moment in an incident that has seen nearly 4,000 BTC moved out of the sidechain’s control, raising questions about the security of federated bridge models and the long-term stability of the L-BTC peg.
The recovery transaction was officially recorded at 16:09:25 UTC and confirmed within Bitcoin block 965950. While the return of a substantial portion of the missing funds provides some relief to the ecosystem, the situation remains far from resolved. The individuals responsible for the initial movement of funds, who have characterized themselves as white-hat hackers, did not return the entirety of the drained assets. According to on-chain data, approximately 598.5 BTC—valued at roughly $47 million at the time—was retained by the entities involved in the exploit.
As of September 8, the infrastructure supporting the Liquid Network continues to face significant disruptions. Blockstream, the primary developer behind the Liquid protocol, maintains a status page indicating an active security incident and a major outage affecting public bridge nodes. This ongoing instability has forced secondary service providers to halt operations to protect users from further volatility or loss.
Key Developments in the Liquid Recovery
- A total of 3,400 BTC was returned to the Liquid federation wallet on September 7, 2026, following an estimated outflow of 3,996 BTC.
- Self-described white-hat hackers retained approximately 598.5 BTC, representing a significant portion of the original drain.
- Blockstream continues to report a major outage for public bridge nodes, while SideSwap has suspended all swap and pegging services.
- A security patch was issued alongside an on-chain message, with signatures reportedly verifying against Blockstream’s security keys.
The Mechanics of the Recovery Transaction
The movement of 3,400 BTC back into the federation’s custody follows a period of intense speculation regarding the nature of the original drain. Initial estimates suggested that approximately 3,996 BTC had been removed from the federation wallet, a move that threatened the 1:1 backing of the Liquid Bitcoin (L-BTC) token. The return of the majority of these funds via block 965950 suggests a negotiated or voluntary return rather than a forced recovery by network developers.
The retention of 598.5 BTC by the exploiters introduces a complex dynamic to the recovery process. In many decentralized finance exploits, white-hat hackers retain a percentage of the funds as a “bounty” for identifying critical vulnerabilities. However, the scale of this retention—nearly $47 million—is substantial. It remains unclear whether this amount was agreed upon by the Liquid federation or if it was unilaterally kept by the hackers as a condition for returning the bulk of the assets.
The discrepancy between the original drain and the returned amount poses a challenge for the network’s reconciliation efforts. For L-BTC to maintain its peg and utility, every token in circulation must be backed by an equivalent amount of BTC held in the federation’s multisig wallet. With nearly 600 BTC still missing, the total supply of L-BTC may currently exceed the physical Bitcoin reserves held by the federation, unless other compensatory measures are taken.
Service Disruptions and Network Status
Despite the return of the 3,400 BTC, the Liquid Network is not yet operating at full capacity. Blockstream’s status monitoring tools indicate that the security incident is still active. The most critical failure point currently identified is the outage of public bridge nodes. These nodes are essential for the “peg-in” and “peg-out” processes, which allow users to move Bitcoin between the mainchain and the Liquid sidechain.
The impact of these outages has rippled through the Liquid ecosystem. SideSwap, a major decentralized exchange and wallet provider for the Liquid Network, announced a total pause on its core services. This includes swaps, peg-ins, and peg-outs. The platform stated that these services would remain offline until Liquid’s core infrastructure is confirmed to be fully resumed and stable. This freeze effectively locks users into their current positions within the sidechain, preventing them from redeeming their L-BTC for mainchain Bitcoin.
The disruption highlights the centralized risks inherent in federated sidechain models. Unlike the Bitcoin mainnet, which relies on decentralized proof-of-work, Liquid relies on a federation of functionaries to validate transactions and manage the bridge. When a security incident occurs, the reliance on these specific entities can lead to total service halts that are not possible on the underlying Bitcoin network.
The Role of the Federation and Security Patches
Technical details regarding the vulnerability that allowed the drain are still emerging. On the morning of September 7, at 09:41:26 UTC, an on-chain message accompanied a technical patch. The message claimed that the bridge nodes had been successfully patched and that it was safe for the funds to be returned to the federation. This communication was a precursor to the 3,400 BTC transaction that occurred later that day.
Security analysts have noted that the signature for the patch claim reportedly verifies against Blockstream’s official security key. This suggests that the developers were in active communication with the entities holding the funds or were at least providing the necessary technical environment to facilitate a safe return. The patch likely addressed the “fatal network flaw” that was rumored to have preceded the incident.
Reports prior to the recovery suggested that the exploit may have involved the creation of tokens “out of thin air.” If such a flaw existed, it would mean that the total supply of L-BTC could have been artificially inflated, allowing the exploiters to drain the Bitcoin reserves by redeeming these unbacked tokens. The patch issued by Blockstream is expected to have closed this loophole, though a full post-mortem report has yet to be released to the public.
Implications for L-BTC Backing
The primary concern for users of the Liquid Network is the integrity of the L-BTC peg. Liquid operates on the premise that for every 1 L-BTC issued on the sidechain, 1 BTC is held in reserve by the federation. The recent drain of 3,996 BTC and the subsequent return of only 3,400 BTC creates a mathematical deficit in the reserves.
Until the federation can reconcile the outstanding L-BTC tokens with the actual Bitcoin held in the recovery wallet, the sidechain’s solvency remains a matter of technical debate. If the 598.5 BTC retained by the hackers is not replaced, the federation may face a shortfall. This could lead to a situation where not all L-BTC holders are able to peg-out to the mainchain, potentially causing L-BTC to trade at a discount relative to Bitcoin on secondary markets.
The incident also serves as a case study for the security of Bitcoin layer-2 and sidechain solutions. While sidechains offer faster transactions and increased privacy, they introduce trust assumptions that differ from the Bitcoin mainnet. The Liquid federation model is designed to be more secure than a single centralized exchange, but this event demonstrates that it is not immune to systemic vulnerabilities or large-scale capital outflows.
What Happens Next
The immediate priority for Blockstream and the Liquid federation is the restoration of public bridge nodes. Without these nodes, the network remains an isolated silo, and the 3,400 BTC returned to the wallet cannot be accessed by the general user base for redemptions. A timeline for the resumption of these services has not yet been provided, as developers continue to monitor the stability of the recent patches.
Following the restoration of services, a comprehensive audit of the L-BTC supply will be necessary. This reconciliation process will determine if the “thin air” token creation rumors were accurate and exactly how many L-BTC tokens are currently in circulation compared to the BTC reserves. The community is also awaiting a formal statement regarding the 598.5 BTC retained by the white-hat hackers and whether there are plans to recover those funds or if they will be written off as a security expense.
Finally, the broader Bitcoin community will likely scrutinize the federation’s response to this incident. The transparency of the post-mortem report and the speed at which SideSwap and other partners can safely resume operations will be critical in determining whether user confidence in the Liquid Network can be fully restored. For now, the network remains in a state of cautious recovery, with the majority of funds back in the vault but the doors to the bridge still firmly locked.