The individual who extracted approximately 4,000 BTC from the Liquid Network federation wallet over the weekend has sent back about 85% of the assets after Blockstream announced that its bridge nodes received a patch.
The alleged white-hat individual interacted with Blockstream utilizing Bitcoin OP_RETURN data and PGP-encrypted text. Within a dispatch at block 965,875, the entity instructed Blockstream to “fix the bug first” and verify that every node is patched prior to sending the assets back.
The Adam Back-helmed Blockstream then transmitted a PGP-authenticated onchain message stating, “Bridge nodes are patched, safe to return the funds.” The signature authenticates against the security credential displayed on Blockstream’s site. The perpetrator subsequently transferred 3,400 BTC back to the federation destination in block 965,950, retaining roughly 598.5 BTC ($47.3 million) inside the perpetrator’s wallet.
The transfer came after an earlier communication from the hacker proposing to route the bulk of the bitcoin back to the federation location. Blockstream initially reached out to the individual via a transfer at block 965,822, urging them to reach out to the organization’s security personnel.
Dialogue between the groups commenced after Liquid announced on Sept. 6 that roughly 4,000 BTC, valued at approximately $320 million at the time, had been pulled from its federation wallet. The assets were extracted utilizing the SideSwap Peg-out Authorization Key, though that specific key remained uncompromised, according to the network.
In a declaration on X, SideSwap explained that the impacted transaction encompassed 4,000 LBTC routed to its peg-out offering. The system burned the tokens using a legitimate peg-out authorization, following which the Liquid Federation transferred 3,996 BTC to the user’s Bitcoin destination.
Blockstream later verified that the LBTC had been generated via a flaw inside the Elements platform, per SideSwap. The trading venue noted that neither its infrastructure nor its peg-out authorization key experienced any compromise.
Liquid had halted network operations, with bridge nodes deactivated and LBTC deposits and withdrawals halted across trading platforms. SideSwap indicated that swaps, peg-ins, and peg-outs would stay suspended until the network goes live again.
Updated with additional details throughout.
Originally published at https://www.theblock.co/news/defi/2026-09-07-liquid-network-attacker-says-they-will-return-most-of-4000-btc-after-bug-fix-413673.
