Approximately 4,000 bitcoin – worth about $320 million at current market rates – were withdrawn from the Liquid Network, a Bitcoin sidechain that provides settlement services for a number of cryptocurrency exchanges. The actors behind the theft identified themselves as “white‑hat” hackers and told Blockstream, the company that maintains the network’s core code, that they intend to return most of the stolen coins once a vulnerability in the Elements software is fixed. In response, the Liquid Network halted all transactions on the chain on Saturday, effectively freezing the platform while the incident is investigated.
Background on the Liquid Network
Liquid is a federated sidechain that operates alongside Bitcoin’s main blockchain. It is designed to enable faster, confidential transactions and to act as a settlement layer for participating exchanges, allowing them to move large sums of bitcoin off‑chain and settle trades more efficiently. The network is governed by a federation of trusted members – including several major exchanges – that collectively hold a reserve of bitcoin used to back the sidechain’s assets.
Details of the exploit and the attackers’ claim
According to multiple outlets, the breach exploited a flaw in Elements, the open‑source library that underpins Liquid’s confidential transaction capabilities. The attackers reportedly contacted Blockstream after extracting the funds, stating that they would return the majority of the 4,000 BTC once a patch is deployed across the federation. Blockstream has not publicly confirmed the details of the vulnerability but acknowledged that the network is currently “paused” while a fix is being prepared.

“We are white‑hats. We will return most of the 4,000 BTC after the bug is patched,” the group said in messages to Blockstream, as cited by Cointelegraph and The Block.
The perpetrators’ self‑designation as “white‑hats” contrasts with the typical perception of a hack as a criminal act, and their promise to restore the funds has drawn both skepticism and cautious optimism from industry observers.
Market impact and industry reaction
The incident comes at a time when Bitcoin’s price has been volatile, and the crypto sector remains sensitive to security breaches. While the exact effect on Bitcoin’s market price has been muted, the loss of $320 million from a key settlement layer underscores lingering concerns about the robustness of second‑layer solutions. Exchanges that rely on Liquid for cross‑border settlement may need to adjust liquidity strategies while the network remains offline.

Industry analysts note that the size of the theft places it among the largest crypto‑related hacks of 2026. The breach also highlights the ongoing risk associated with complex, multi‑party systems that depend on shared codebases. “Any vulnerability in the underlying software can have cascading effects across the ecosystem,” said a senior analyst at a blockchain research firm, speaking on condition of anonymity.
Regulators in several jurisdictions have been monitoring crypto‑related security incidents more closely, but no official statements have been released specifically about the Liquid hack. Blockstream’s spokesperson indicated that the company is cooperating with the federation members and law‑enforcement agencies to trace the movement of the withdrawn coins.
As the Liquid Network works to implement the necessary patches, the broader crypto community will be watching to see whether the self‑identified white‑hats follow through on their promise to return most of the stolen assets. A successful restitution could set a precedent for how ethical hackers engage with the industry, while a failure would likely deepen mistrust in sidechain solutions and could accelerate the shift toward alternative settlement mechanisms.
Market Snapshot
| Asset | Price | 24h | Market Cap |
|---|---|---|---|
| $79,419 | -0.65% | $1594.8B | |
| $2,491 | -0.44% | $304.0B | |
| $744.22 | -1.69% | $99.1B | |
| $1.4 | -1.43% | $87.8B | |
| $104.89 | -1.51% | $61.5B | |
| $0.0896 | -0.48% | $14.0B | |
| $0.220 | -0.03% | $8.2B |
Live data: CoinGecko — 2026-09-07 11:22 UTC