Liquid

Osmosis

Bitcoin

A reported exploit against Liquid, the Bitcoin sidechain operated by the Blockstream-led federation, has left roughly 600 BTC outstanding after a partial recovery, according to incident reporting that has not been independently confirmed on-chain. The figure represents what remains under an attacker's control following the return of the bulk of an initial withdrawal, and the exact balance, root cause, and permanence of the loss are still unverified.
<div class="on-chain-data" style="background:#0d0f17;border-left:3px solid #f7931a;padding:16px 20px;margin:20px 0;border-radius:4px;">
 WHAT TO KNOW
 <ul style="margin:0;color:#e6edf3;">
 <li>Reporting describes a Liquid exploit that left an outstanding balance near 600 BTC after most of the withdrawn funds were returned.</li>
 <li>The exact remaining amount, the exploit mechanism, and whether the shortfall is permanent remain unverified in the available sources.</li>
 </ul>
</div>
<h2 id="liquid-exploit-reportedly-leaves-about-600-btc-outstanding">Liquid Exploit Reportedly Leaves About 600 BTC Outstanding</h2>
Liquid Network acknowledged a security incident in an official statement dated <a href="https://x.com/Liquid_BTC/status/2096696272447218108" rel="noopener noreferrer nofollow">September 6, 2026</a>, saying purported white-hat hackers had withdrawn approximately 4,000 BTC from the Liquid Federation wallet. The statement described that amount as roughly $320 million at the time, a historical estimate rather than a current valuation. For related coverage, see <a href="https://www.bitcoininfonews.com/revolut-passports-bitcoin-histories-reportedly-obtained/" rel="noopener noreferrer nofollow">Hackers Reportedly Obtained Revolut Passports, Bitcoin Data</a>.
<figure style="margin:24px 0;padding:24px;border:1px solid #dbe3eb;border-left:5px solid #176b87;border-radius:8px;background:#f5f8fb;font-family:Arial,sans-serif;">
 Initial withdrawal reported by Liquid Network
 ~4,000 BTC
 <figcaption style="margin:0;color:#475569;font-size:14px;line-height:1.6;">
 Liquid Network’s September 6, 2026 statement said approximately 4,000 BTC was withdrawn from the Liquid Federation wallet. This initial amount is not the remaining balance or a determination of permanent loss. Source: Liquid Network.
 </figcaption>
</figure>
Most of that Bitcoin was subsequently returned. TechCrunch reported on September 8 that around <a href="https://techcrunch.com/2026/09/08/a-hacker-stole-340m-in-a-crypto-heist-then-returned-most-of-it/" rel="noopener noreferrer nofollow">3,400 BTC had been returned</a>, attributing the update to former Blockstream executive Samson Mow, with roughly 600 BTC, then described as about $47 million, still under the actor's control. For related coverage, see <a href="https://www.bitcoininfonews.com/blockstream-ransom-alleged-liquid-network-hack/" rel="noopener noreferrer nofollow">Blockstream Rejects Ransom After Alleged 4,000 BTC Liquid Hack</a>.
The company's initial post said the Blockstream team was working to contact the actors on-chain with a signed message. Liquid framed the withdrawal as the work of purported white-hat hackers, a characterization the entity itself supplied rather than an independently established fact.
<blockquote class="twitter-tweet" style="margin:20px 0; padding:16px 18px; background:#1a150d; color:#f3f4f6; border:1px solid #f7931a; border-radius:12px; margin:20px 0; padding:16px 18px; background:#1a150d; color:#f3f4f6; border:1px solid #f7931a; border-radius:12px">
 We are aware of a security incident on <a rel="noopener noreferrer nofollow" href="https://x.com/Liquid_BTC?ref_src=twsrc%5Etfw">@Liquid_BTC</a>. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The <a rel="noopener noreferrer nofollow" href="https://x.com/Blockstream?ref_src=twsrc%5Etfw">@Blockstream</a> team is working on contacting them on-chain with a signed message. What we know so far is that the funds…— Liquid Network 🌊 (@Liquid_BTC) <a rel="noopener noreferrer nofollow" href="https://x.com/Liquid_BTC/status/2096696272447218108?ref_src=twsrc%5Etfw">September 6, 2026</a>
</blockquote>
Source: @Liquid_BTC on X
More granular reporting from crypto.news put the outstanding balance at <a href="https://crypto.news/liquid-network-recovers-3400-btc-after-bridge-exploit/" rel="noopener noreferrer nofollow">598.5 BTC</a> and placed the return in Bitcoin block 965,950. Those figures remain attributed reporting because the underlying transaction was not independently traced to a block explorer. Blockstream's own posture toward the actors has been firm, and it has separately <a href="https://www.bitcoininfonews.com/blockstream-liquid-hacker-50-million-bounty-demand/" rel="noopener noreferrer nofollow">rejected a reported bounty demand</a> tied to the incident.
<h2 id="which-recovery-numbers-hold-up-and-which-are-disputed">Which Recovery Numbers Hold Up, and Which Are Disputed</h2>
The white-hat framing has drawn pushback. crypto.news attributed criticism to Ledger Chief Technology Officer Charles Guillemet, who questioned the description because nearly 600 BTC remained with the actors and no approved bounty terms had been publicly disclosed. That is a single attributed reaction, not a representative measure of sentiment.
Whether the actors were authorized researchers entitled to retain any Bitcoin is unverified. According to unconfirmed reports, the retention reflects white-hat terms, but the fetched reporting states that no bounty agreement was publicly disclosed. The claim that exactly 600 BTC was permanently lost is likewise unconfirmed; the sourced figure is an outstanding balance after partial recovery, not a final loss determination.
The reported 598.5 BTC balance dates to September 7 and may since have changed. No current explorer balance or later official recovery accounting was available, so the outstanding amount should be read as a snapshot rather than a settled figure. This distinguishes the alleged initial loss from any net loss after recovery, neither of which is established here.
<h2 id="follow-on-phishing-and-the-evidence-still-needed">Follow-On Phishing and the Evidence Still Needed</h2>
Blockstream issued a security announcement on September 9 warning that impersonators were exploiting the incident. The company said users were not required to move funds, enter recovery phrases, re-peg assets, or install software sent by email, adding that Blockstream will never ask for a recovery phrase or PIN, <a href="https://blog.blockstream.com/phishing-alert-do-not-act-on-unsolicited-liquid-or-blockstream-messages/" rel="noopener noreferrer nofollow">or ask users to send funds anywhere</a>.
Liquid's operational status remains partial. At retrieval, the project's official blog banner said issued-asset transfers had <a href="https://blog.liquid.net/" rel="noopener noreferrer nofollow">resumed while L-BTC transfers and peg-out operations remained paused</a>. The banner carried no timestamp, so the resumption should not be read as a full restoration of service.
Substantiating the headline claim would require an attributable statement from the affected entity paired with corroborating transaction evidence, neither of which has been independently fetched. A technical postmortem establishing whether unbacked L-BTC was minted, the affected software version, and remediation steps is also absent. The episode echoes earlier delayed-detection cases such as the <a href="https://www.bitcoininfonews.com/osmosis-74-days-40-btc-nomic-exploit/" rel="noopener noreferrer nofollow">Osmosis Nomic exploit</a>, where reconciling on-chain reality took time, and mirrors the disputed accounting seen in <a href="https://www.bitcoininfonews.com/blockstream-refuses-ransom-47m-bitcoin-liquid-hack/" rel="noopener noreferrer nofollow">other reporting on the same Liquid hack</a>.
Bitcoin itself was little moved against this backdrop. BTC traded at <a href="https://www.coingecko.com/en/coins/bitcoin" rel="noopener noreferrer nofollow">$77,348</a> at press time, up 0.25% over 24 hours, with the broad crypto Fear &amp; Greed Index at 61, or Greed, a market-wide gauge rather than a Liquid-specific signal. The sidechain's federated peg is distinct from Bitcoin's base layer, whose UTXO set, difficulty adjustments, and proof-of-work security remain unaffected by federation-level custody events. Verifiable settlement on that base layer is precisely the property any final loss accounting will ultimately have to reconcile against.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
<a href="https://bitcoininfonews.com/" rel="noopener noreferrer nofollow">Bitcoininfonews</a> first published the article titled <a href="https://www.bitcoininfonews.com/?p=41693" rel="noopener noreferrer nofollow">Liquid Exploit Reportedly Results in 600 BTC Loss</a>.

Liquid Exploit Reportedly Results in 600 BTC Loss

Table of Contents

BitcoinInfoNews.Com

Other articles published on Sep 13, 2026

Join our free newsletter for daily crypto updates!