Short answer: On September 7, 2026, the attackers who drained Blockstream's Liquid Network returned 3,400 BTC, roughly $270 million, to the federation wallet once its bridge nodes were patched. They kept about 598.5 BTC, around $47 million or 15% of the haul, so L-BTC is still not fully backed and the Liquid sidechain stays paused until the gap is closed.
What happened
A day earlier, on Sunday, September 6, about 4,000 BTC left the federation wallet that backs L-BTC, the bitcoin token of the Liquid sidechain. The attackers had used a bug in Elements, the software Liquid runs on, to create unbacked L-BTC and redeem it for real bitcoin. They then described themselves as white hats in messages written into Bitcoin transactions and said they would give the coins back once the flaw was fixed and every node was updated.
On Monday, September 7, Blockstream posted a message signed with its PGP key saying its bridge nodes had been patched. At 16:09 UTC the same day, 3,400 BTC arrived back at the federation's address. The remaining 598.5 BTC stayed with the attackers.
Timeline of the Liquid hack and partial return
| When (UTC) | Event |
|---|---|
| Sept 4–5 | Attacker tests the system with small peg-ins and trial transactions, according to on-chain investigators |
| Sept 6, afternoon | About 4,000 BTC paid out of the federation wallet via a SideSwap peg-out |
| Sept 6, evening | On-chain message: the senders call themselves white hats and ask for contact |
| Sept 7, morning | Blockstream confirms in a signed message that bridge nodes are patched |
| Sept 7, 16:09 | 3,400 BTC returned; 598.5 BTC retained |
Bounty or extortion: why the 598 BTC matters
The Liquid hackers have not published any agreement that turns the retained coins into a bounty. Reports say their on-chain messages at one point mentioned a 10% reward, yet they held back about 15%. Ledger's chief technology officer Charles Guillemet argued that keeping funds after negotiating through the blockchain looks closer to extortion than to responsible disclosure.
The distinction is not academic. In the white-hat model, a researcher reports a flaw privately and is paid from a published bug-bounty program; funds are never moved first. Crypto has seen the "take first, return later" pattern before — the 2021 Poly Network attacker handed back roughly $610 million, and the 2023 Euler Finance exploiter returned most of about $197 million — but each time the leverage sat with the attacker, and users could only wait.
- Returned: 3,400 BTC, about 85% of what was taken.
- Retained: 598.5 BTC, about $47 million at around $78,000 per bitcoin.
- Agreement: none made public; Blockstream said it was still engaging with the group.
When will Liquid Network restart?
No date was given. Liquid's operators said the network remains paused while Blockstream and the federation members make further fixes and security improvements, resolve a chain split that appeared during the pause, and prepare a coordinated restart. They also said L-BTC must be fully backed before bridging resumes.
That last point is the open question. After the return, the reserve holds roughly 3,600 BTC against about 4,200 L-BTC in circulation — around 85% coverage. Unless the remaining coins come back, someone has to fill a hole of about 600 BTC, whether Blockstream, the federation or another arrangement. Until that is settled, a one-for-one redemption promise cannot be honoured in full.
Meanwhile, users were told that no action is needed and that they should not send bitcoin to Liquid peg-in addresses until the restart is confirmed. Exchanges that suspended L-BTC deposits and withdrawals are waiting for the same signal.
What it means for you
The partial return is good news for L-BTC holders, but it does not change the underlying lesson: a wrapped or bridged coin is a claim on a reserve, and the reserve is only as strong as the code guarding it. Our guide to cross-chain bridges explains where these risks sit.
- If you hold L-BTC, wait for official restart notices from Liquid and your exchange; do not trust "claim" or "migration" links shared in chats or by direct message.
- Avoid peg-ins for now. Sending BTC to a Liquid peg-in address before the restart is confirmed risks leaving it stuck.
- Be wary of discount offers. Buying L-BTC cheaply on thin markets is a bet on how the remaining gap is covered, not a free arbitrage.
- Keep long-term bitcoin on the Bitcoin network. Use sidechain or wrapped versions only for the task that needs them.
Key takeaways
- On September 7, 2026, the Liquid attackers returned 3,400 BTC after Blockstream patched its bridge nodes.
- They kept 598.5 BTC (about $47 million), and no bounty agreement has been made public.
- L-BTC is backed at roughly 85% after the return; the operators say it must be fully backed before a restart.
- Liquid remains paused with no restart date; users should not peg in until it is confirmed.
If you are moving between BTC and other assets while the sidechain is down, you can use native Bitcoin routes instead — the supported networks page shows which chains are available for each coin.
Sources: CoinDesk, The Hacker News, Bitcoin.com News, Bitquery
Frequently asked questions
Did the Liquid Network hackers return the bitcoin?
Mostly. On September 7, 2026, they returned 3,400 BTC of the roughly 4,000 BTC taken, after Blockstream patched its bridge nodes. They kept about 598.5 BTC, worth around $47 million.
Is L-BTC fully backed after the return?
Not yet. The reserve holds roughly 3,600 BTC against about 4,200 L-BTC, around 85%. Liquid's operators say full backing must be restored before the network restarts.
Can I peg bitcoin into Liquid right now?
No. Peg-ins and peg-outs are paused, and users have been told not to send BTC to Liquid peg-in addresses until the operators confirm the network has restarted.
