Liquid's $320M Drain: 3,400 BTC Came Back, and the 15% Still on the Tape

At 14:06 UTC on Sunday, September 6, nearly the entire bitcoin reserve of the Liquid Network moved in one transaction to an address that had never been used before. The fee was 21 cents. Four hours later the sender attached a note to the blockchain: "we are whitehats. contact us on chain." What follows is the record of a hack that mostly got the money back — which makes it worth reading twice, because a hack that is mostly returned is a different thing from a hack that is over.

The Drain

Roughly 4,000 of the 4,200 bitcoin held in Liquid's federation wallet were pulled out on Sunday, valued at the time around $320 million — about 95 percent of the reserve, leaving only about 197 BTC behind. Liquid runs as a layer-2 sidechain on top of Bitcoin, where exchanges and market makers settle bitcoin as LBTC, a token meant to trade one-for-one with real bitcoin. The drain hit that whole redeemable layer at once, and exchanges that depend on Liquid promptly halted LBTC deposits and withdrawals while the sidechain was paused and bridge nodes disabled.

Then the unusual part. By Monday the actors had returned 3,400 bitcoin, worth about $268 million, while keeping roughly 598.5 BTC — about 15 percent of what they took, or $47 million at the time.

The Window

The detail that matters is where the money actually went out. This was not a stolen key. Liquid confirmed no federation keys were compromised, and no custody was breached. Instead the hole was in issuance. A bug in the range-proof verification cache of Elements — the Bitcoin-based software Liquid nodes run — let the actors mint L-BTC that had no bitcoin behind it. They ran a 2.5 BTC dry run, then sent roughly 4,000 of these fabricated tokens to Sideswap's peg-out service at 14:05 UTC. Sideswap processed it and the federation sent 3,996 real bitcoin to the destination at 14:28 UTC.

The important distinction for a non-technical reader: real bitcoin left through a window built for LBTC holders to exit one-for-one, but the tokens walking through that window were never backed. In ledger terms the peg stayed intact — no LBTC holder is short a satoshi, with 0.22 coin to spare — because the phantom tokens shrank as the reserve did. What broke was the trust that a token minted on Liquid is genuinely redeemable for bitcoin.

The 15% Left on the Tape

The actors named themselves white-hats in an on-chain message and stated they would return the funds once the network was patched and the money declared "safe to return." Blockstream, the company behind Liquid, responded with PGP-signed messages, patched the bridge nodes, and asked to be contacted. No formal agreement about the 15 percent was found in the on-chain messages.

For anyone reading this as an alert about their own holdings, the takeaway is narrower than the headlines. Bitcoin's main network was untouched. The other assets issued on Liquid — USDT, DePix, real-world assets — were not touched. What is alive right now is a freeze: the network stays paused, LBTC deposits and withdrawals stay halted, and operators say they will restart only once they can prove legitimate LBTC is backed 1:1, distribute the patched Elements release, and judge the bridge safe. Until then, LBTC holders cannot redeem.

That freeze is the falsifier on this story, along with one open dollar figure. The roughly 598.5 BTC still in the actors' hands far outweighs the 0.22-coin cushion that kept the peg whole on paper; it is not posted against anything. Someone somewhere decides whether that 15 percent becomes a bug bounty, a stubborn theft, or something in between — and until the network reopens with a demonstrated 1:1 backing, "returned" means most of a reserve is back, not that the record is closed.