Updated Sep 7, 2026, 6:01 a.m. EDT Published Sep 6, 2026, 11:43 p.m. EDT
2 min read
Summary
- Purported white-hat hackers withdrew about 4,000 of the 4,200 bitcoin held in Liquid Network’s federation wallet, prompting the Bitcoin sidechain to halt new transactions.
- Blockstream attributed the incident to a software bug in Elements rather than compromised keys, with the affected funds moving through the approved SideSwap trading platform.
Bitcoin BTC$81,577.53 worth millions of dollars were withdrawn from a settlement network utilized by digital asset exchanges, representing the newest event in a sequence of cyber attacks affecting the industry this year.
The supposed “white hat hacker” is reportedly attempting to behave ethically by promising to give back the taken assets once the software flaw is resolved.
Liquid Network, introduced in 2018 by Blockstream, reported that presumed “white-hat hackers” extracted roughly 4,000 out of the 4,200 bitcoin stored within its federation wallet. The platform is supervised by a coalition comprising over 80 trading venues, infrastructure entities, and portfolio managers.
“Liquid wallets will be impacted, and we’re sorry for any inconvenience,” Liquid Network stated on X, while suspending all fresh transactions. “Federation members are actively working on resolving this so we can restore normal network activity.”
The sidechain suspended fresh operations and cautioned that wallets would experience disruptions while coalition members strive to bring service back online. This situation is significant because Liquid was created to address a practical hurdle for exchanges, specifically the sluggish nature of the Bitcoin ledger. To counter this, the platform generates L-BTC backed by bitcoin locked in reserve so transactions can finalize more swiftly. A depletion of nearly the entire reserve casts doubt on the reliability of that framework.
The breach did not happen because a password or private key was exposed, which is the cause behind the majority of crypto exploits this year. Instead, the stolen capital traveled out via SideSwap, a standard and authorized trading venue.
Subsequently, Blockstream discovered that a programming flaw had generated some of the bitcoin involved inside a framework known as Elements. SideSwap stated it could not differentiate which tokens originated from the defect versus which ones were genuine, so it handled them all equally. Alternative asset classes on the identical network (Liquid) remained unharmed.
A white hat hacker is an ethical security researcher who targets a weakness within a secured environment before malicious actors can exploit it. They typically trigger a vulnerability, relocate the funds, and request a reward to restore them.
The vulnerability in this instance, according to cybersecurity professionals, exists at the node layer inside Liquid’s transaction codebase, rather than a compromise of private keys or cryptographic hardware modules.
Based on the most recent updates, the hacker is communicating with network maintainers through onchain Bitcoin transfers, pledging to refund the capital once the vulnerability is patched.
“Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix,” one message stated.
The breach follows a $6 million drain last week from a lending service connected to Crypto.com alongside an August security breach involving the Coldcard hardware wallet. Liquid has not disclosed when the network will reopen or whether the bitcoin will be reimbursed.
UPDATE (Sept. 7, 05:40 UTC): Adds a paragraph and image about the hacker communicating with the Liquid Network
CORRECT (Sept. 7, 09:59 UTC): Corrects citation from tweet in penultimate paragraph, which substituted “least” for “latest.”
Related Assets
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
Originally published at https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys.
