HACKER ALLEGEDLY TOOK $340M IN BITCOIN, RETURNED MOST OF IT
A Liquid Network hacker allegedly drained about 4,000 bitcoin, worth roughly $340 million, from the Bitcoin settlement network launched by Blockstream on September 6, 2026, then handed back about 3,400 of it a day later once the bug was fixed. On September 11, 2026, Blockstream said it would not pay a ransom for the roughly 600 bitcoin still missing and called holding onto them a crime, not responsible disclosure.
The money left the Liquid Federation wallet on a Sunday, Dexerto reported. Liquid, launched by Blockstream in 2018 and used by crypto exchanges and other financial institutions, said on X that a “white hat” hacker took the funds, Yahoo Finance reported.
The attacker reportedly exploited a bug to pull the coins out. The Hacker News reported that SideSwap pointed to a bug in Elements, the software Liquid runs on, as the reason the L-BTC used in the withdrawal could be created. Blockstream said the SideSwap Peg-out Authorization Key was not compromised.
Liquid paused operations. Digital Market Reports said exchanges were told to suspend L-BTC deposits and withdrawals until things restarted. TechCrunch, citing the Rekt leaderboard, said the theft ranked among the largest crypto thefts of the year.
A heist negotiated in on-chain messages
The attacker’s terms were simple: fix the bug and the money comes back. The Block reported that the two sides talked through Bitcoin OP_RETURN messages and PGP-encrypted text, which is a very formal way to haggle over a few hundred million dollars.
According to The Block, the attacker’s message was to “fix the bug first” and make sure every node was patched. Blockstream then sent a PGP-signed on-chain reply: “Bridge nodes are patched, safe to return the funds.”
On September 7, 2026, about 3,400 bitcoin landed back at a Liquid Federation address at 16:09 UTC, The Hacker News reported. The Block said the return was recorded in block 965,950 and left about 598.5 bitcoin in the attacker’s wallet.
Samson Mow, a former Blockstream executive, said the same day that the bug had been fixed and the coins returned. He said Liquid would stay paused until more fixes and security improvements were in place. The roughly 600 bitcoin left over were worth about $47 million.
That means the attacker gave back about 85% of what was taken and kept the rest.
Blockstream says no deal
Blockstream did not accept the white hat label for long. Unchained reported that the attackers had sought a 10% fee on the 4,000 bitcoin taken.
Blockstream shot that down in a statement on X, as quoted by Unchained and DailyCoin: “Blockstream will not pay a ransom for the return of stolen funds.” It added: “Taking assets without authorization and withholding their return is a crime, not responsible disclosure.”
Blockstream also said it would not set a precedent of paying developers or attackers to return stolen assets. If the remaining bitcoin was not returned voluntarily, the company said, it would work with law enforcement, exchanges, service providers and forensic specialists to trace the funds and apprehend those responsible.
As of September 11, 2026, about 600 bitcoin, worth roughly $47 million, were still in the attacker’s hands, and Blockstream’s answer to the fee request was a flat no.
