Hackers Stole $320 Million Worth of BTC but Returned Most of It!

Hackers stole 4,000 Bitcoins from the Liquid Network and demanded that the network fix security vulnerabilities. After the network complied, they returned 85% of the stolen BTC. What vulnerability were they referring to, and what did the conversations between Liquid and the hackers look like?

The hackers responsible for the attack on the Liquid Network and the theft of 4,000 Bitcoins kept their word, albeit not completely. After previously demanding that the network fix all security flaws, they returned the stolen Bitcoins just a few minutes ago. This occurred right after Blockstream confirmed that the vulnerabilities in the bridge nodes had been patched, which was a demand from the individual or individuals behind the attack. However, it turns out that not all Bitcoins returned to their rightful place, as 3,400 Bitcoins were sent back to the wallet, indicating that the hackers decided to keep 600 BTC for themselves. This is no small amount, as it is worth over $47 million at the current exchange rate.

Update: 3,400 BTC of the roughly 4,000 BTC withdrawn on September 6 has been returned to the @Liquid_BTC Federation wallet. The return followed confirmation from @Blockstream that the affected bridge nodes have been patched. Approximately 598 BTC remains outstanding, and... --- Samson Mow (@Excellion) September 7, 2026

They stole BTC worth $320 million. What was the hackers' attack on Liquid Network about?

Over the weekend, hackers stole 4,000 Bitcoins from the official wallet of the Liquid Network, worth approximately $320 million. The target of the attack was a wallet that was supposed to contain around 4,200 BTC, and the funds were siphoned off through the SideSwap bridge. The network immediately halted all transactions and issued a statement assuring that there had been no breach of the Bitcoin blockchain. The operation was said to have been conducted by exploiting a vulnerability in the Liquid infrastructure.

Interestingly, the statement referred to the perpetrators as "white-hat hackers." This term typically describes hackers whose actions have a positive motive. This could suggest that the aim of the attack was not merely to steal Bitcoins, but rather to draw attention to some security flaw. And as it turns out, that was indeed the case.

We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn 4,000 BTC ($320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.

What we know so far is that the funds... --- Liquid Network 🌊 (@Liquid_BTC) September 6, 2026

It was about a vulnerability in the commit. We know this from the blockchain conversation.

The attackers left a message on the blockchain stating, "we are whitehats. contact us on chain." The conversation quickly made its way to the network, allowing us to observe how the network negotiated with the hackers and what their demands were. Previous suggestions were confirmed that the aim was to draw attention to a security flaw. The attackers wrote that the current commit chain is at risk and demanded that Liquid Network ensure that all vulnerabilities are patched. They assured that as soon as they were confident that the threat had been eliminated, they would return the stolen funds. As we mentioned, they kept their word, but it remains unclear whether they will return the remaining 600 Bitcoins. It is worth noting that observing the conversation through the blockchain is at least interesting. You can see the record of the conversation below:

The discussion between @Blockstream and the white-hat hacker (WHH) regarding the ~4000 BTC from @Liquid_BTC is happening in public. It seems to be their preference over email. As it's hard to follow the chain of messages in OP_RETURN, here's a summary with links.

11:30 AM PDT -... https://t.co/IEXyFpBITx --- Samson Mow (@Excellion) September 7, 2026

Read also:

• Bitcoin falls below $80,000. Will crypto return to declines due to this data?
• New arrest in the Zondacrypto case. It concerns a collaborator of Sylwester Suszek
• Institutions are withdrawing from Bitcoin ETF funds. BTC price under pressure

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.