Liquid leak reportedly resulted in 600 BTC loss

The Liquid network was attacked by a vulnerability, and about 600 BTC was still not returned after partial recovery.

According to reports that have not yet been independently confirmed on the chain, Liquid, the Bitcoin sidechain operated by the Blockstream-led alliance, encountered a reported exploit incident. After most of the funds were recovered, approximately 600 BTC is still outstanding. This figure represents the remaining balance that remains under the control of the attacker after most of the funds from the initial withdrawal were returned. Questions about the exact balance, root cause and whether the loss is permanent have not yet been verified.

Summary of Key Information

The report pointed out: A loophole in the Liquid network resulted in a balance of nearly 600 BTC still outstanding after most of the withdrawal funds were returned.

Things to be verified: The exact remaining amount, vulnerability mechanism and whether the difference is a permanent loss have not been verified from existing sources.

Detailed incident and responses from all parties

Liquid Network issued an official statement on September 6, 2026, admitting that a security incident occurred. The statement said the "so-called" white-hat hackers withdrew approximately 4,000 BTC from the Liquid Alliance wallet. The statement said the amount was approximately $320 million at the time, but this was a historical estimate rather than a current valuation.

We have noticed a security incident at @Liquid_BTC. The so-called white-hat hackers have extracted approximately 4,000 BTC (approximately US$320 million) from the Liquid Alliance wallet.@ The Blockstream team is contacting them online via signed messages. What we know so far is funds... -- Liquid Network (@Liquid_BTC) September 6, 2026

Liquid Network stated in a statement on September 6 that approximately 4,000 BTC was withdrawn from the Liquid Alliance Wallet. It should be noted that this initial amount is not a final balance and does not represent a determination of permanent loss.

Subsequently, most of the bitcoins were returned. TechCrunch reported on September 8 that approximately 3,400 BTC had been returned. The report quoted former Blockstream executive Samson Mow as saying that approximately 600 BTC (worth approximately $47 million) was still under the control of the actors at the time.

The company's initial post stated that the Blockstream team was working to contact these actors online via signed messages. Liquid describes these withdrawals as the work of "so-called white-hat hackers", a characterization provided by the entity itself rather than an independently established fact.

Data disputes and recovery

More detailed reporting from crypto.news puts the outstanding balance at 598.5 BTC and places the return operation in Bitcoin block 965,950. Since the underlying transactions are not independently tracked on blockchain browsers, these data are still attributed reports and unconfirmed.

Blockstream has been very tough on these actors and has individually rejected a reward request related to the incident.

Which recovered data is trustworthy and which is controversial?

The "white hat" framework has been refuted. Crypto.news quoted criticism from Ledger's chief technology officer Charles Guillemet, who questioned the description because nearly 600 BTC remained in the hands of actors and there was no publicly approved bounty clause. This is only an attribution reaction and does not represent general emotions.

Whether the actor is an authorized researcher with the right to retain any bitcoins has not been verified. According to unconfirmed reports, the retention of funds reflects the white hat clause, but reports obtained indicate that no bounty agreement has been publicly disclosed. The claim that exactly 600 BTC suffered permanent losses is also unconfirmed; the figures cited are the outstanding balance after partial recovery, rather than the final determination of loss.

The 598.5 BTC balance reported as of September 7 and may have changed since then. There is currently no current browser balance or subsequent official recovery accounting data available, so the outstanding amount should be considered a snapshot rather than an established figure. This helps to distinguish the initial loss that is allowed from any net loss after recovery, which is not established here.

Subsequent phishing attacks and required evidence

Blockstream issued a security advisory on September 9, warning that someone pretended to be an official and took advantage of the incident. The company said users do not need to transfer funds, enter recovery mnemons, re-anchor assets or install software to send emails, and emphasized that Blockstream will never require users to provide recovery mnemons or PIN codes, or send funds anywhere.

Liquid's operating status is still incomplete. At the time of retrieval, the project's official blog banner showed that transfers of issued assets had been resumed, but L-BTC transfers and exit peg-out operations were still suspended. There is no timestamp on the banner, so recovery should not be interpreted as a full recovery of services.

Confirming the headline claims requires a statement of attribution from the affected entity and evidence of the corrupting transaction, neither of which was independently obtained. In addition, there is a lack of technical post-mortem analysis to establish whether unsupported L-BTC was cast, which software versions were affected, and remedial steps. The incident is reminiscent of early cases of delayed detection, such as the Osmosis Nomic vulnerability, in which time was actually spent on the coordination chain, and reflects controversial accounting treatments in other reports of the same Liquid hacking incident.

In this context, Bitcoin itself fluctuates little. BTC was quoted at $77,348 at press time, rising 0.25% in 24 hours, and the broad cryptocurrency fear and greed index was 61 (greed), a market-wide indicator rather than a signal for Liquid. The federation anchoring of sidechains is different from Bitcoin's base layer in that its UTXO set, difficulty adjustments, and proof-of-work security are not affected by federation-level escrow events. Verifiable settlements at the base level are the attributes with which any final loss accounting must ultimately be reconciled.

Disclaimer : This article is for reference only and does not constitute financial or investment advice. There are significant risks in the cryptocurrency and digital asset markets. Be sure to conduct independent research before making a decision.