A reported exploit against Liquid, the Bitcoin sidechain operated by the Blockstream-led federation, has left roughly 600 BTC outstanding after a partial recovery, according to incident reporting that has not been independently confirmed on-chain.
A reported exploit against Liquid, the Bitcoin sidechain operated by the Blockstream-led federation, has left roughly 600 BTC outstanding after a partial recovery, according to incident reporting that has not been independently confirmed on-chain. The figure represents what remains under an attacker’s control following the return of the bulk of an initial withdrawal, and the exact balance, root cause, and permanence of the loss are still unverified.
WHAT TO KNOW
- Reporting describes a Liquid exploit that left an outstanding balance near 600 BTC after most of the withdrawn funds were returned.
- The exact remaining amount, the exploit mechanism, and whether the shortfall is permanent remain unverified in the available sources.
Liquid Exploit Reportedly Leaves About 600 BTC Outstanding
Liquid Network acknowledged a security incident in an official statement dated September 6, 2026, saying purported white-hat hackers had withdrawn approximately 4,000 BTC from the Liquid Federation wallet. The statement described that amount as roughly $320 million at the time, a historical estimate rather than a current valuation. For related coverage, see Hackers Reportedly Obtained Revolut Passports, Bitcoin Data.
Initial withdrawal reported by Liquid Network
~4,000 BTC
Most of that Bitcoin was subsequently returned. TechCrunch reported on September 8 that around 3,400 BTC had been returned, attributing the update to former Blockstream executive Samson Mow, with roughly 600 BTC, then described as about $47 million, still under the actor’s control. For related coverage, see Blockstream Rejects Ransom After Alleged 4,000 BTC Liquid Hack.
The company’s initial post said the Blockstream team was working to contact the actors on-chain with a signed message. Liquid framed the withdrawal as the work of purported white-hat hackers, a characterization the entity itself supplied rather than an independently established fact.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds…
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
Source: @Liquid_BTC on X
More granular reporting from crypto.news put the outstanding balance at 598.5 BTC and placed the return in Bitcoin block 965,950. Those figures remain attributed reporting because the underlying transaction was not independently traced to a block explorer. Blockstream’s own posture toward the actors has been firm, and it has separately rejected a reported bounty demand tied to the incident.
Which Recovery Numbers Hold Up, and Which Are Disputed
The white-hat framing has drawn pushback. crypto.news attributed criticism to Ledger Chief Technology Officer Charles Guillemet, who questioned the description because nearly 600 BTC remained with the actors and no approved bounty terms had been publicly disclosed. That is a single attributed reaction, not a representative measure of sentiment.
Whether the actors were authorized researchers entitled to retain any Bitcoin is unverified. According to unconfirmed reports, the retention reflects white-hat terms, but the fetched reporting states that no bounty agreement was publicly disclosed. The claim that exactly 600 BTC was permanently lost is likewise unconfirmed; the sourced figure is an outstanding balance after partial recovery, not a final loss determination.
The reported 598.5 BTC balance dates to September 7 and may since have changed. No current explorer balance or later official recovery accounting was available, so the outstanding amount should be read as a snapshot rather than a settled figure. This distinguishes the alleged initial loss from any net loss after recovery, neither of which is established here.
Follow-On Phishing and the Evidence Still Needed
Blockstream issued a security announcement on September 9 warning that impersonators were exploiting the incident. The company said users were not required to move funds, enter recovery phrases, re-peg assets, or install software sent by email, adding that Blockstream will never ask for a recovery phrase or PIN, or ask users to send funds anywhere.
Liquid’s operational status remains partial. At retrieval, the project’s official blog banner said issued-asset transfers had resumed while L-BTC transfers and peg-out operations remained paused. The banner carried no timestamp, so the resumption should not be read as a full restoration of service.
Substantiating the headline claim would require an attributable statement from the affected entity paired with corroborating transaction evidence, neither of which has been independently fetched. A technical postmortem establishing whether unbacked L-BTC was minted, the affected software version, and remediation steps is also absent. The episode echoes earlier delayed-detection cases such as the Osmosis Nomic exploit, where reconciling on-chain reality took time, and mirrors the disputed accounting seen in other reporting on the same Liquid hack.
Bitcoin itself was little moved against this backdrop. BTC traded at $77,348 at press time, up 0.25% over 24 hours, with the broad crypto Fear & Greed Index at 61, or Greed, a market-wide gauge rather than a Liquid-specific signal. The sidechain’s federated peg is distinct from Bitcoin’s base layer, whose UTXO set, difficulty adjustments, and proof-of-work security remain unaffected by federation-level custody events. Verifiable settlement on that base layer is precisely the property any final loss accounting will ultimately have to reconcile against.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
