Liquid incident remains active after 3,400 BTC return
A party controlling the funds withdrawn during the Liquid Network security incident returned 3,400 BTC to the federation address, although approximately 598.5 BTC remained at the actor-controlled address in the latest reported update. Blockstream’s incident page was still marked Active at the evidence cutoff on 7 September 2026, with public bridge nodes experiencing a major outage.
The recovery changes the financial position reported at the start of the incident. Blockstream initially acknowledged that approximately 4,000 BTC, valued at about US$320 million at the time, had been withdrawn from the Liquid Federation wallet on 6 September. That figure describes the gross withdrawal and should not be treated as the current net loss following the return of most of the funds.
The Block reported that the 3,400 BTC was sent back to the federation address through an on-chain transaction on 7 September. The transaction provides observable evidence that an external party had controlled the withdrawn assets and then returned a large portion of them. No final recovery figure has been established, and the status or intended treatment of the remaining 598.5 BTC is unknown.
The incident affected Liquid, a Bitcoin sidechain, rather than Bitcoin’s base consensus or protocol. Liquid uses L-BTC within its own federated system, with BTC held in a federation wallet supporting movement between the sidechain asset and Bitcoin. The reviewed evidence does not indicate that the Bitcoin base network was compromised, and it continued to operate.
The withdrawal route has raised a separate question about how a peg-out could be processed without compromised authorisation or federation keys. Liquid Network and Blockstream said the transaction used the SideSwap Peg-out Authorization Key, but maintained that this key and the other relevant keys were not compromised. That account is only partially confirmed, pending a full technical report.
SideSwap, in a statement reported by The Block, said its service received 4,000 L-BTC under a customer order and processed what appeared to be a valid peg-out. SideSwap said it was later told that the L-BTC had originated from an Elements software bug rather than a compromise of its own systems. This offers a possible explanation for how the service could process the request while the relevant keys remained secure: the L-BTC presented to the service may itself have been created without the expected backing.
Blockstream has not publicly established that explanation in a postmortem. Bitquery separately associated the incident with a recently fixed verification-cache issue, but Blockstream had not confirmed that more specific diagnosis by the evidence cutoff. No reviewed evidence established that SideSwap was compromised or responsible for the suspected underlying flaw.
Communications with the party controlling the BTC also took place through messages recorded on-chain. An initial message associated with the recipient address described the responsible party or parties as white hats and requested contact. That description is self-asserted: no individual, group, location, affiliation or motive has been independently verified.
According to Bitquery’s account of the communications, the party indicated that funds would be returned after the vulnerability was fixed and relevant nodes were patched. The Block later reported that Blockstream sent a PGP-signed on-chain message saying bridge nodes had been patched and that the funds could safely be returned. The subsequent transfer of 3,400 BTC followed that reported message, but it does not independently establish the actor’s identity or legal characterisation.
Blockstream’s operational response remained broader than the reported patch deployment. It disabled public bridge nodes and effectively paused the Liquid sidechain, preventing new transactions from being submitted. Exchanges were notified to suspend L-BTC deposits and withdrawals, while Liquid wallet functionality was affected by the network pause. The Block also reported that SideSwap swaps, peg-ins and peg-outs remained suspended. No timetable for full service restoration had been confirmed.
These restrictions were temporary mitigations, separate from any permanent software correction. The reported patching of bridge nodes supports the existence of a partial deployed fix, but Blockstream had not published a fixed Elements release, an affected-version range, a CVE or a formal security bulletin. There was also no public confirmation that every relevant federation, bridge or independent node had received a compatible update, or that normal network activity had resumed. No authoritative user-side workaround had been published beyond waiting for official restoration guidance.
No separate proof-of-concept code was identified in the reviewed material. Real-world exploitation is nevertheless confirmed by the successful withdrawal, the traced settlement and the later return from funds controlled by the external party. The absence of public exploit code does not alter the evidence that the incident was carried out against the live system.
Liquid and Blockstream said other Liquid assets, including USDT, DePix and tokenised real-world assets, were unaffected, although that claim was not independently confirmed in the reviewed sources. The incident temporarily removed most of the BTC in the federation wallet before the partial return, creating uncertainty around L-BTC backing and settlement while services remained paused.
No final customer loss, reimbursement obligation or federation-member liability had been publicly established. It was also unclear whether Blockstream, federation members, SideSwap, exchanges or L-BTC holders would absorb any eventual shortfall. There was no confirmed Australia-specific victim, exchange suspension, federation-member impact or regulatory response.
The next material updates will need to resolve three separate issues: whether the remaining BTC is returned, when Liquid and associated services can safely resume, and what software versions require remediation. Until Blockstream publishes restoration guidance and a definitive postmortem, the reported bridge-node patches should not be treated as proof that the incident has been fully resolved.
