- Published on
Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
- Authors
- Name
- DeepHorus
Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
In a dramatic turn of events, the hackers who exploited a bug in the Liquid Network’s Elements software have returned 3,400 of the roughly 4,000 Bitcoin they stole on September 6. The funds were sent back to a Liquid Federation address on September 7, but approximately 598.5 BTC—worth about $47 million at current prices—remain unreturned. The Liquid Network remains paused, preventing holders from redeeming their L-BTC tokens for Bitcoin.
Liquid is a Bitcoin sidechain that enables faster, confidential transactions via a token called L-BTC, which is backed 1:1 by real Bitcoin held in a federation wallet. The network is operated by Blockstream and a federation of members. Before the hack, the federation held about 4,200 BTC. The incident, which saw 95% of reserves withdrawn, is one of the largest exploits in Bitcoin’s sidechain history.
According to Blockstream’s incident notice, hackers claiming to be white hats took approximately 4,000 BTC, valued at around $320 million at the time. The returned 3,400 BTC represented about 85% of the stolen funds. The remaining 598.5 BTC was not a separate payment but the change from the same transaction, sent back to the originating address. At a Bitcoin price of $78,000 on September 8, the unreturned amount is worth roughly $47 million.
The Bitcoin was moved using SideSwap’s Peg-out Authorization Key, which releases funds from the sidechain. Blockstream stressed that the key was not compromised. Instead, SideSwap reported that a bug in Elements, the software underlying Liquid, had artificially created the L-BTC used in the withdrawal. A peg-out destroys L-BTC and releases the matching Bitcoin. The two parties communicated via messages embedded in Bitcoin transactions, with the attackers demanding a patch before returning funds.
The return of most funds offers some relief, but the unreturned $47 million and the ongoing network pause highlight serious risks. Short-term, Liquid users cannot redeem their L-BTC, causing liquidity issues. Long-term, the incident raises questions about the security of federated sidechains and the robustness of Elements. It also sets a precedent for white-hat hackers negotiating on-chain, potentially encouraging similar exploits.
Industry reactions have been mixed. Samson Mow, CEO of JAN3 and former Blockstream executive, confirmed that Blockstream is still in contact with the group and that about 598 BTC remain outstanding. The community has closely watched the on-chain negotiations, with some praising the white-hat claim and others criticizing the centralization of the federation. Bitcoin’s market price remained stable despite the news, suggesting limited immediate contagion. Blockstream has deployed updated software and is preparing a coordinated restart.
Looking ahead, the Liquid Federation aims to restart the network once all nodes are patched. Whether the remaining 598.5 BTC will be returned remains uncertain. The incident may accelerate calls for more rigorous audits of sidechain software and could impact trust in Liquid. Meanwhile, the hackers’ identity and motives are still unknown, and law enforcement may get involved. The crypto community will watch closely for further developments.
