Liquid Sidechain Stays Paused With 598 BTC of $320M Still Out

Blockstream's Liquid sidechain was still paused on Wednesday, three days after roughly 4,000 BTC was withdrawn from the federation wallet that backs it. The company's status page, read at the time of writing, listed the incident as active and the public bridge nodes as disabled. Most of the coins came back on Monday, after the people who took them said on chain that they were white hats and would return the funds once the bug was patched. They kept about 598.5 BTC, worth roughly $47 million. Blockstream put the original withdrawal at about $320 million.

How the coins left

The flaw sat in Elements, the open-source software Blockstream uses to run Liquid, and it let someone mint L-BTC that the network accepted as real. L-BTC is the sidechain's wrapped form of bitcoin, meant to be backed one for one by coins the federation holds. Those invalid tokens went to SideSwap's peg-out service, which burned them and triggered the federation to release actual bitcoin. SideSwap says neither its systems nor its peg-out authorization key were compromised, and no federation keys were taken. Crypto Briefing, alone, describes the underlying bug as a range-proof verification cache error and puts the federation at an 11-of-15 multisig. Decrypt is the only account carrying the drawdown, with reserves falling from about 4,205 BTC to 197 BTC before operations stopped.

Two counts of what came back

The returned amount depends on which desk is counting. CoinDesk's headline on Tuesday, Unchained, DailyCoin and The Hacker News all say 3,400 BTC went back, about $270 million, leaving 598.5 coins in the takers' hands. The Record says 2,665 BTC came back, about $266.5 million, and puts the retained share at nearly 15% of the total. Those do not reconcile. The higher pair adds to 3,998.5 coins, which is the roughly 4,000 that left; The Record's pair leaves about 736 BTC unaccounted for, and no account addresses the gap. The dates wobble as well. Most outlets put the withdrawal on Sunday 6 September, while The Record writes "Sunday, September 8", a date that fell on a Tuesday.

The negotiation happened in public

All of it ran on chain. An early message from the takers read "we are whitehats, contact us on chain", followed by a demand that the flaw be fixed and every node patched before anything went back. The Hacker News, alone in this sweep, times the return: a 0.00001 BTC transaction carrying an encrypted PGP message at 15:31 UTC on Monday, then the 3,400 BTC transfer 38 minutes later. Not everyone accepts the label the senders chose for themselves.

"The 'white hats' still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!" said Charles Guillemet, Ledger's chief technology officer, in remarks Decrypt published.

DailyCoin reports that no public statement from Blockstream or the federation has confirmed the retained bitcoin was ever offered as a reward, and that reading rests on that outlet alone. It is the part of the story with no document behind it. What Liquid itself has said is narrower: discussions with the individuals responsible are ongoing to secure the return of the remaining funds.

Nothing pegs in or out yet

Patched software has been deployed and federation members have prepared a coordinated restart, on Unchained's account, but the chain has not resumed. Exchanges have paused L-BTC deposits and withdrawals. Other assets on Liquid, including USDT and DePix, were untouched. Samson Mow, who runs JAN3, told users not to send bitcoin to peg-in addresses until the restart is confirmed, a warning that one account carries and the others do not. This was a software failure rather than a stolen key, which puts it on the smaller side of the year's ledger: stolen keys have cost more than code bugs have across 2026. Cronos took the harder road after its own incident and restarted its chain with the exploit rolled back. Blockstream has reversed nothing, and it has not said when Liquid opens again.