Liquid Network Attacker Sends Back Most of the Stolen Bitcoin, Keeps $47M
A bug in the Elements software behind Bitcoin's Liquid sidechain let someone drain nearly 4,000 bitcoin. Most of it came back the next day. Roughly 598 bitcoin, worth about $47 million, has not.
Key points
- Someone drained nearly 4,000 bitcoin from the Liquid Network on Sunday, 6 September, and the following day about 3,400 coins were returned.
- Around 598.5 bitcoin, worth roughly $47 million at current prices, is still in the attacker's hands.
- Liquid is a Bitcoin sidechain, a separate network that holds real bitcoin to back a token called L-BTC, so any shortfall means that token is no longer fully backed.
- The network remains paused: holders of L-BTC cannot swap the token back for real bitcoin.
- The root cause was a flaw in Elements, the open-source software Liquid runs on, developed by Blockstream.
Someone walked off with almost 4,000 bitcoin from the Liquid Network on Sunday, 6 September. Most of it came back the next day. Nobody outside the attacker knows why roughly 598.5 bitcoin didn't.
What is the Liquid Network and why does this matter?
Liquid is a sidechain, a smaller network running alongside Bitcoin that holds real bitcoin in reserve to back its own token, L-BTC. Traders and exchanges use it for faster settlement. Every L-BTC is supposed to be matched one-for-one by a real bitcoin locked up on Liquid.
When coins go missing, that token stops being fully backed. That's why operators paused the network. Holders of L-BTC can't redeem their tokens for actual bitcoin until it restarts, and Blockstream hasn't said when that will be.
How did the attacker get in?
The attacker exploited a bug in Elements, the open-source software Liquid is built on. Blockstream maintains Elements and also runs much of Liquid's infrastructure. The flaw let someone move bitcoin out of Liquid's reserves without the usual permission checks.
Blockstream had not published a full technical writeup as of this reporting. What the on-chain data shows is that the movement was substantial and fast. It's a failure mode familiar to anyone who has written a post-mortem on multi-party custody: one software defect can gut the maths that's supposed to make theft impossible. Our earlier story on the Coldcard firmware bug that may have cost holders $70 million shows the same pattern: a single quiet flaw, years of exposure, catastrophic outcome.
What happens to the money that came back?
| Item | Amount | Status |
|---|---|---|
| Total taken | ~4,000 BTC | Drained on 6 Sept |
| Returned | ~3,400 BTC | Sent back 7 Sept |
| Still missing | ~598.5 BTC | ~$47M at current price |
| Network status | Liquid | Paused, no redemptions |
The returned coins landed at an address Blockstream controls. Partial returns like this point to one of two things: the attacker is negotiating a bounty, or they kept a share they believe they can launder. The industry tends to dress these up as "whitehat" returns. They're closer to ransom.
Should ordinary crypto users worry?
If you don't hold L-BTC or trade on an exchange that uses Liquid, this doesn't touch you directly. Regular bitcoin on the main Bitcoin network is unaffected. The bug lived in Elements, not in Bitcoin itself.
If you do hold L-BTC, you can't redeem it right now. Watch Blockstream's status page. Be wary of anyone in your inbox or on social media offering to "help" you recover funds. Every large crypto incident pulls a wave of follow-on scams within days, and Bitcoin theft has attracted increasingly brazen criminal behavior as the sums involved have grown.
The post-mortem here will say what they always say: a sidechain is only as trustworthy as the code holding the reserves. One bug is your entire risk model.
