Liquid exploit drains Bitcoin reserves before most funds are returned
Attackers created unbacked Liquid Bitcoin and withdrew approximately 4,000 BTC from the sidechain’s reserve. They subsequently returned 3,400 BTC, leaving a substantial unrecovered balance despite describing themselves as white hats.
On September 6, 2026, an exploit of Liquid Network’s transaction-validation software allowed attackers to create approximately 4,000 unbacked L-BTC and obtain real bitcoin through the peg-out path. Liquid is a Bitcoin sidechain: its L-BTC normally represents bitcoin held in a reserve, rather than additional coins issued by Bitcoin’s base protocol.
The failure involved cached cryptographic-proof verification. Invalid transaction data could be treated as already checked, allowing balances without corresponding deposits to pass validation. Conversion of the resulting L-BTC through SideSwap and the peg-out system turned a sidechain accounting failure into a loss of reserve BTC. Bitcoin’s own supply rules were not changed.
The attackers communicated with Blockstream through Bitcoin transactions and claimed to be white hats willing to return funds after remediation. On September 7 at 16:09 UTC, they returned 3,400 BTC. Blockstream’s assessment left roughly 602 BTC outstanding; partial restitution did not establish an agreed bounty or prove the attackers’ motives.
The incident exposed the dependence of a backed Bitcoin asset on the additional software and redemption machinery surrounding it. Most reserve funds came back, but fixing validation, recovering funds and restoring service remained distinct tasks. The unusual return reduced the loss without erasing the breach or making the reserve immediately whole.