Hackers Return $263 Million Stolen From Liquid Network
Alleged white-hat hackers exploited a vulnerability in the Liquid Network's federation wallet, stealing approximately 4,000 Bitcoin (~$320 million). The hackers demanded that the vulnerability be fixed before returning the stolen funds. To date, about 3,400 Bitcoin (~$263 million) have been returned, with roughly 598 Bitcoin (~$47 million) still outstanding. The incident caused Liquid to suspend transactions and pause network activity while federation members work on fixes and security improvements. The exact method of the theft remains unclear, but the SideSwap Peg-out Authorization Key was involved without being compromised. Other Liquid assets were unaffected by this incident.
AI Analysis
Technical Summary
The Liquid Network, a Bitcoin sidechain developed by Blockstream, suffered a theft of approximately 4,000 Bitcoin from its federation wallet. The attackers, claiming to be white-hat hackers, exploited a vulnerability that allowed withdrawal of funds via the SideSwap Peg-out Authorization Key, although this key itself was not compromised. Following the theft, Liquid disabled nodes and suspended transactions to contain the incident. The hackers demanded that the vulnerability be fixed before returning the stolen funds, and have since returned 3,400 Bitcoin. The network remains paused as federation members work on resolving the chain split and implementing security improvements. The incident affected Liquid wallets and services, but other assets such as USDT, DePix, and RWAs remained unaffected. Exchanges have been notified and have paused LBTC deposits and withdrawals.
Potential Impact
Approximately 4,000 Bitcoin (~$320 million) were stolen from the Liquid Network's federation wallet, disrupting network operations and causing suspension of transactions. The theft impacted Liquid wallets and services, leading to paused deposits and withdrawals on exchanges. Other assets on the Liquid Network were not affected. The network remains paused during remediation efforts, affecting normal user activity. Partial recovery of stolen funds has been made, but a significant amount remains outstanding. The incident highlights a critical security vulnerability in the federation wallet mechanism.
Mitigation Recommendations
The Liquid Network has suspended all transactions and disabled nodes to contain the incident. Federation members are actively working on fixes and security improvements to resolve the vulnerability and the resulting chain split. Exchanges have paused LBTC deposits and withdrawals to prevent further impact. Users of Liquid wallets should expect continued service disruptions until the network safely restarts. The hackers have indicated they will return the remaining stolen funds once the vulnerability is fixed and confirmed. No additional mitigation steps are currently recommended beyond those implemented by Liquid and its federation members.
Hackers Return $263 Million Stolen From Liquid Network
Description
Alleged white-hat hackers exploited a vulnerability in the Liquid Network's federation wallet, stealing approximately 4,000 Bitcoin (~$320 million). The hackers demanded that the vulnerability be fixed before returning the stolen funds. To date, about 3,400 Bitcoin (~$263 million) have been returned, with roughly 598 Bitcoin (~$47 million) still outstanding. The incident caused Liquid to suspend transactions and pause network activity while federation members work on fixes and security improvements. The exact method of the theft remains unclear, but the SideSwap Peg-out Authorization Key was involved without being compromised. Other Liquid assets were unaffected by this incident.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Liquid Network, a Bitcoin sidechain developed by Blockstream, suffered a theft of approximately 4,000 Bitcoin from its federation wallet. The attackers, claiming to be white-hat hackers, exploited a vulnerability that allowed withdrawal of funds via the SideSwap Peg-out Authorization Key, although this key itself was not compromised. Following the theft, Liquid disabled nodes and suspended transactions to contain the incident. The hackers demanded that the vulnerability be fixed before returning the stolen funds, and have since returned 3,400 Bitcoin. The network remains paused as federation members work on resolving the chain split and implementing security improvements. The incident affected Liquid wallets and services, but other assets such as USDT, DePix, and RWAs remained unaffected. Exchanges have been notified and have paused LBTC deposits and withdrawals.
Potential Impact
Approximately 4,000 Bitcoin (~$320 million) were stolen from the Liquid Network's federation wallet, disrupting network operations and causing suspension of transactions. The theft impacted Liquid wallets and services, leading to paused deposits and withdrawals on exchanges. Other assets on the Liquid Network were not affected. The network remains paused during remediation efforts, affecting normal user activity. Partial recovery of stolen funds has been made, but a significant amount remains outstanding. The incident highlights a critical security vulnerability in the federation wallet mechanism.
Defensive Guidance
The Liquid Network has suspended all transactions and disabled nodes to contain the incident. Federation members are actively working on fixes and security improvements to resolve the vulnerability and the resulting chain split. Exchanges have paused LBTC deposits and withdrawals to prevent further impact. Users of Liquid wallets should expect continued service disruptions until the network safely restarts. The hackers have indicated they will return the remaining stolen funds once the vulnerability is fixed and confirmed. No additional mitigation steps are currently recommended beyond those implemented by Liquid and its federation members.
Technical Details
- Classification
- {"confidence":0.3,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.securityweek.com/hackers-return-263-million-stolen-from-liquid-network/","fetched":true,"fetchedAt":"2026-09-08T16:37:13.894Z","wordCount":1002}
Threat ID: 6aa039b9acd9273b49ec0ed6
Added to database: 09/08/2026, 16:37:13 UTC
Last enriched: 09/08/2026, 16:37:19 UTC
Last updated: 09/09/2026, 00:14:05 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.