Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
A bug in Liquid’s code let someone mint <a href="https://xpertsstudio.com/microstrategy-puts-its-bitcoin-identity-on-a-250-pair-of-nike-jordans/” title=”MicroStrategy Puts Its Bitcoin Identity on a $250 Pair of Nike Jordans”>Bitcoin-backed tokens out of thin air, drain 95% of the federation wallet, and then claim they did it to help. Whether that story holds up depends on what happens to the coins…
This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.
Around 4,000Bitcoin(CRYPTO:BTC), worth about $320 million, drained out of the Liquid Network federation wallet on September 6, 2026, and Blockstream says no private key was stolen. The wallet held about 4,200 BTC before, so 95% of the Bitcoin backing the sidechain left in one transaction. Blockstream paused the network and blocked redemptions, so holders of L-BTC, the token meant to represent Bitcoin one-for-one on Liquid, can’t convert it back into real coins.
Ordinary Bitcoin holders on the base layer aren’t affected, with Bitcoin’s price trading around $79,700–$80,000 at the time of the incident. The attackers attached a message to the transaction saying, “we are whitehats. contact us on chain,” and Blockstream responded on-chain the same day. A white hat is generally expected to report a vulnerability responsibly rather than take funds first, which makes the incident harder to classify. So how much of this is a real security event, and how much is theater?
What Liquid Is and Why L-BTC Depends on the Federation Wallet
Liquid is a Bitcoin sidechain, meaning it is a separate blockchain designed to move value faster and with more privacy than the Bitcoin base layer while keeping its main asset backed by real Bitcoin. Blockstream built Liquid, which has run since 2018, and a federation of 15 members operates it and jointly controls the multisignature wallet holding the underlying BTC.
When you peg in, you send real Bitcoin to the federation and receive L-BTC on Liquid. When you peg out, you burn L-BTC and the federation releases the corresponding amount of real Bitcoin back to you.
That one-for-one backing promise is what gives L-BTC its value. If the federation wallet holds less BTC than the L-BTC issued against it, the token becomes a partial claim on Bitcoin, worth whatever the market thinks it can eventually recover. The problem is limited to Liquid, so if you hold BTC directly on the Bitcoin base layer, your coins are not held in the federation wallet, and you are not exposed to this incident.
How the Coins Left the Federation Wallet
Blockstream says no key was stolen, which makes this look less like a conventional hack. At 14:05 UTC on September 6, someone sent4,000 L-BTC to SideSwap, a federation member that processes peg-outs, and SideSwap said it handled the order like any other. The L-BTC was burned on Liquid with a valid authorization, and at 14:28 UTC the federation paid 3,996 BTC to the customer’s Bitcoin address.
Eleven of the federation’s fifteen keys signed the transaction because, under the network’s rules, it looked valid. Blockstream hasn’t published a full post-mortem, but early analysis points to a bug in Elements, the open-t was never backed by any Bitcoin
The difference matters because a stolen key would be a custody failure that the federation could address by rotating its signers. However, a bug that lets someone mint unbacked tokens and redeem them through the normal process is a protocol failure, which is harder to dismiss as carelessness and harder to fix without changing how the peg works.
The attackers’ on-chain message read “we are whitehats. contact us on chain,” and Blockstream replied by sending 1,000 satoshis to the address with a message pointing to its security contact. The two sides have since exchanged PGP-signed notes, a cryptographic signing method that lets a receiver confirm a message really came from the claimed sender’s key.
According to on-chain messages reported byGalaxy Research’s Alex Thorn, the attackers have said they intend to return most of the funds once the vulnerability is patched. However, no agreement has been announced, and the network has not said when it will resume operations.
What an L-BTC Holder Owns While the Network Is Paused
If you hold L-BTC, your token still exists in your wallet, but you cannot convert it back into real Bitcoin while the network is paused. Every L-BTC in circulation is backed by the federation’s reserve, and about 95% of that reserve has been withdrawn.
Until Blockstream publishes updated figures for the reserve and the amount of L-BTC in circulation, no one can say exactly how much Bitcoin backs each token or when peg-outs will resume. The situation improved on September 7 when the attackers returned 3,400 BTC to the federation’s address.They kept about 598.5 BTC, worth roughly $47.3 million at the time, meaning most of the stolen Bitcoin was recovered, but the reserve was still short of the amount needed to fully back L-BTC.
Exchanges have suspended L-BTC deposits and withdrawals, while USDT and other assets on Liquid remain unaffected.
Does This Move Bitcoin, or Just Bruise Blockstream?
BTC has traded around $78,000 to $81,000over the past week and is up 21% over the past month, with the Liquid hack having little to no visible impact on its price. The Bitcoin base layer did not lose any coins, and the market appears to have treated the incident as a problem with Liquid rather than with Bitcoin itself.
The return of 3,400 BTC gives Liquid a path to recovery, but the incident is not over. About 598.5 BTC is still with the attackers, peg-outs remain paused, and Blockstream still needs to show that the remaining L-BTC can be fully backed by the federation’s reserves.
For Liquid to put the incident behind it, the missing Bitcoin needs to be returned or otherwise accounted for, peg-outs need to resume, and Blockstream needs to provide clear figures showing that the L-BTC supply matches the Bitcoin held in reserve.
Until that happens, the biggest damage may not be to Bitcoin itself but to confidence in Liquid’s promise that every L-BTC can be exchanged for one Bitcoin.
Contact [email protected] for any questions or corrections.
Sam Daodu is a crypto analyst who’s spent nearly a decade making blockchain understandable—no easy task when most whitepapers read like fever dreams. He writes for 24/7 Wall St., covering Bitcoin, altcoins, and crypto market analysis for investors. Before crypto, he was a tech writer (back when explaining “the cloud” was peak innovation). Since 2018, he’s written for CoinTelegraph, Yahoo Finance, The Block, Cryptonews, Zypto, Rain, and more—basically anywhere people want crypto news without the headache. Sam runs MacLabs Marketing, a content agency for crypto brands tired of sounding like AI wrote their website. He also publishes free crypto education on his site for Web3 enthusiasts who think “gas fees” is a typo. When he’s not writing or staring at charts, Sam’s either: – Watching anime (currently convinced One Piece has better tokenomics than most altcoins) – At the gym sculpting himself into a Greek god – Listening to the music your mum warned you only bad boys listen to Connect: LinkedIn | Email | MacLabs Marketing
Source: 247wallst.com