On Sep 7, 2026, actors who drained most of Liquid Network’s bitcoin reserves returned 3,400 BTC, about $268 million, to the federation address after Blockstream said bridge nodes had been patched and funds were safe to return, according to news.bitcoin.com. The actors’ address retained 598.49955894 BTC, about $47 million, roughly 15% of the haul. No on-chain message identified that remainder as an agreed bounty.
The incident began Sep 6, when about 4,000 BTC, then worth about $320 million, left the federation wallet that backs L-BTC — around 95% of the reserve, leaving about 197 BTC. Liquid said no federation keys were compromised. SideSwap said its systems were not breached. Independent reconstructions cited by news.bitcoin.com point to a range-proof verification cache bug in Elements, the Bitcoin Core fork used by Liquid nodes, that allowed unbacked L-BTC to be created and later pegged out for real bitcoin. A 2.5 BTC dry run preceded about 4,000 L-BTC reaching SideSwap’s peg-out service at 14:05 UTC; the federation sent 3,996 BTC at 14:28 UTC.
As of Sep 7 reporting, Liquid remained paused, bridge nodes were disabled, and centralized-exchange L-BTC deposits and withdrawals stayed halted. Other Liquid-issued assets, including USDT, DePix, and RWAs, were not touched. Bitcoin’s base layer was unaffected. The Block and Decrypt also reported the partial return of funds after the bug-fix step.
news.bitcoin.com (Jamie Redman, Sep 7, 2026); The Block; Decrypt