Liquid Network drained of about $319 million in bitcoin, and 85% is returned
September 6, 2026 (September 6 to 7, 2026)
On September 6, attackers drained about 4,000 BTC, roughly $319 million, from the reserve wallet of the Liquid Network, a Bitcoin sidechain built and run by Blockstream. TRM Labs' reconstruction points to a flaw in how the Elements software caches the results of range-proof checks, which may have let an invalid output pass as already verified. The attackers minted unbacked L-BTC and requested a withdrawal, and the signers approved it because the software treated the chain as valid. Blockstream said none of its signing keys were compromised and has patched the bug. On September 7 the attackers returned about 3,400 BTC (about 85%) and kept about 598 BTC, calling it a bounty and describing themselves as white-hat hackers, which is unverified. As of September 8 the network was paused and redemptions halted.
Why it matters
It was the biggest theft of 2026 at that point, and the money came back only because the attackers chose to return it. The signers followed their rules and still approved a bad transaction.
What defenders can take from it
- Treat shortcuts in verification code, such as caches, as security-critical and test them against invalid input.
- Add withdrawal limits and delays so a bug cannot empty a reserve in minutes.