Skip to content
Today
Sections

Security Reports disagree7 publishers 2 min read Published Updated

Liquid's thieves set a patch as the price of returning 4,000 BTC

Blockstream paused the Liquid bridge after roughly 4,000 BTC left the federation wallet, and the people holding it will send most of it back only once the flaw is fixed, which puts the patch timetable in their hands.

The Watch · Security desk

Send a correction

Illustration accompanying Liquid's thieves set a patch as the price of returning 4,000 BTC
Generated illustration

What happened

  • Roughly 4,000 BTC, about 95 percent of all bitcoin pegged into the Liquid sidechain, was withdrawn from the Liquid Federation wallet on Sunday.
  • Liquid disabled its bridge nodes and paused the network, and the withdrawn coins were consolidated into one address carrying the message "we are whitehats. contact us on chain."
  • Blockstream opened an on-chain channel at block 965,822 with 1,000 satoshis and an OP_RETURN message, and the actors replied at block 965,869 asking whether returning "most" of the BTC would be acceptable.
  • Their condition, as reconstructed by Galaxy Research head Alex Thorn, was that the vulnerability be fixed across the network first: "Please fix the bug first."
  • blockchain.news subsequently reported that the hackers returned $270 million in bitcoin after initially taking $320 million.

Why it matters

  • Who's exposed exposure Every claim on the sidechain's pegged bitcoin now depends on a stranger's follow-through, because the backing sits outside federation control until the coins move back.
  • What it limits constraint Blockstream has to fix and deploy the flaw on a schedule set by the party holding the collateral, and shipping that fix tells every other researcher where to look.
  • What it sets up precedent A theft settled by keeping a slice and calling the rest a rescue prices an unagreed bug bounty for the next bridge operator who gets the same offer.

Alex Thorn's reconstruction verifies one side of the conversation. The PGP signature on Blockstream's message checks against the company's published public key, which is why the outreach can be tied to Blockstream [8]. The other end of the exchange remains unauthenticated. The only established fact about the counterparty is that they control the coins [18]. The reply landed 47 blocks after the outreach [17].

The arithmetic is worth doing before the framing. Roughly 4,000 BTC valued at about $320 million prices the haul near $80,000 a coin [16]. blockchain.news reports that $270 million came back [5], which leaves $50 million outstanding, about 16 percent of what left the wallet [15]. At the $79,324.17 bitcoin price that same publisher quotes, the shortfall is around 630 BTC [20]. That return is single-sourced; the fuller reporting of the exchange has the funds still under the actors' control, with no figure ever attached to "most" [18]. If the $270 million holds, the promise was honored to the letter and the remainder is a fee the federation never agreed to.

The condition is what separates this from a straightforward theft. A demand denominated in a patch still sets a schedule someone else has to meet, and the federation has to write and ship the fix across the network while the counterparty holds the collateral [4]. Publishing it narrows the search area for everyone else reading. Charles Guillemet, Ledger's CTO, made the same point from the other direction when he argued the flaw could be found by pointing powerful AI systems at it, with no disclosure process involved [14].

Ronin and Euler appear in this material only as scale comparators in Guillemet's initial skepticism about the white-hat claim [12], not as negotiation precedents. The evidence backs a single live case, no broader trend line. What it does support is specific: 95 percent of the bitcoin pegged into the sidechain sat in a stranger's wallet [1], and days into the incident Blockstream was still describing itself as working on contacting them [11]. The message in the consolidating transaction [6] shifted the tone of the exchange and shifted Guillemet's read [13], though custody itself never moved. Liquid's own language holds that line by calling the actors purported white-hats [10]. For a responder, the coins are stolen until they are in a federation address, and the patch shipping under this timetable is one the federation did not schedule.

What to watch

  • On-chain confirmation from Blockstream that funds reached a federation address, and the exact remainder kept.
  • Whether Blockstream publishes the vulnerability and its fix, and whether the patch lands before or after any return.
  • Whether "most" ever gets a number, or the roughly 630 BTC gap is left unaccounted for.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence72
Adoption
Not scored
Hype gap+15
Incentives55
Confidence70

Perspective Coverage

7 publishers
Builder
Builder 26%
Operator
Operator 41%
Investor
Investor 33%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Approximately 4,000 BTC was withdrawn from the Liquid Federation wallet on Sunday, representing about 95% of the bitcoin that had been pegged into the Liquid sidechain.

    Reported Supported
  2. [2]

    The incident involved roughly $320 million worth of BTC.

    Reported Supported
  3. [3]

    Following the withdrawals, Liquid disabled its bridge nodes and paused the network.

    Reported Supported
  4. [4]

    The proposal came with the condition that the vulnerability be fixed first; the hackers told Blockstream "Please fix the bug first."

    Reported Supported
  5. [5]

    blockchain.news reported that the Liquid hackers returned $270 million in BTC after initially taking $320 million.

    Reported SupportedView cited source
  6. [6]

    The stolen funds were consolidated into a Bitcoin address containing a message reading: "we are whitehats. contact us on chain."

    Reported Supported
  7. [7]

    According to Galaxy Research head Alex Thorn, Blockstream attempted to contact the actors at Bitcoin block 965,822, sending 1,000 satoshis with an OP_RETURN message intended to alert its security team and open a communication channel.

    Reported Supported
  8. [8]

    A later transaction included encrypted material addressed to the holder of the relevant key along with a PGP signature; according to Thorn, the signature could be verified against Blockstream's published public key, indicating the communication was connected to the company.

    Reported Supported
  9. [9]

    The purported white-hat hackers responded at block 965,869, moved their own balance, sent 1,000 satoshis to the federation's peg wallet, and asked whether returning "most" of the withdrawn BTC to the federation address would be acceptable.

    Reported Supported
  10. [10]

    Liquid has continued to describe the individuals involved as purported white-hat hackers, reflecting uncertainty over their identity and intentions.

    Reported Supported
  11. [11]

    As of the afternoon of September 6, Blockstream had only said that it was "working on contacting" the "purported white-hat hackers".

    Reported Supported
  12. [12]

    Ledger CTO Charles Guillemet was initially skeptical, arguing conventional white-hat hackers do not drain hundreds of millions of dollars from a bridge, and compared the situation with major exploits such as Ronin and Euler.

    Reported Supported
  13. [13]

    Guillemet's position softened after the hackers attempted to communicate with Blockstream; he noted criminal groups do not typically try to establish direct contact with victims, and wrote "There's hope."

    Reported Supported
  14. [14]

    Guillemet argued the vulnerability could potentially be researched using powerful AI systems to identify the underlying flaw without relying on proper disclosure procedures.

    Reported Supported
  15. [15]

    If $270 million of a $320 million theft was returned, $50 million remains outstanding, about 16% of the original amount.

    Derived Supported
  16. [16]

    The stated $320 million value against roughly 4,000 BTC implies a price of about $80,000 per bitcoin.

    Derived Supported
  17. [17]

    The actors' reply came 47 blocks after Blockstream's outreach.

    Derived Supported
  18. [18]

    The message does not specify how much BTC would be returned, there is no guarantee the return will occur, and until funds move back to the federation-controlled address almost all of the bitcoin remains under the unidentified actors' control.

    Reported Contested
  19. [19]

    blockchain.news quoted BTC trading at $79,324.17.

    Reported Contested
  20. [20]

    At the $79,324.17 bitcoin price quoted by blockchain.news, the $50 million shortfall is roughly 630 BTC.

    Derived Contested

Sources

7 independent publishers whose own reporting we read for this story.

  1. blockchain.news

    6 articles · September 7, 2026

    Bitcoin: 4000 BTC Moved From Liquid Network | Flash News Detail | Blockchain.News
  2. securityaffairs.com

    1 article · September 8, 2026

    Hackers Drain $320 Million From Liquid Network, Then Return Most of It
  3. securityweek.com

    2 articles · September 8, 2026

    Hackers Return $263 Million Stolen From Liquid Network
  4. thecyberexpress.com

    2 articles · September 7, 2026

    Liquid Network Hackers Demand Bug Fix Before Returning $320M BTC
  5. thehackernews.com

    1 article · September 8, 2026

    Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
  6. therecord.media

    1 article · September 8, 2026

    ‘White hat’ hackers take $47 million bounty after $320 million crypto theft

  7. web3isgoinggreat.com

    2 articles · September 6, 2026

    Web3 is going great

Topics and entities

Topics

Entities