Blockstream's Liquid Network Reserve Drained in $320 Million Exploit
Hackers exploited a software flaw to drain 95% of the federation reserve, returning most funds while retaining 600 BTC.
Hackers drained approximately 4,000 BTC from the Blockstream Liquid Network federation reserve on September 6, 2026. The breach, which occurred over a 23-minute window, represents one of the most significant cryptocurrency security failures of the year.
The attackers exploited a critical software bug that allowed them to create unbacked L-BTC tokens. These fraudulent tokens were then exchanged for actual reserve Bitcoin, specifically through SideSwap, resulting in a loss of roughly $320 million. Prior to the incident, the federation wallet held approximately 4,200 BTC, meaning the exploit successfully drained about 95% of the network's total reserves.
The Sidechain Mechanism
Liquid is a federated sidechain developed by Blockstream designed to facilitate faster, off-chain Bitcoin settlements. To maintain its functionality, the network relies on a federation of nodes that manages a reserve of Bitcoin. This reserve is intended to back the L-BTC tokens issued on the sidechain at a strict 1:1 peg, ensuring that every token on the network is redeemable for an equivalent amount of Bitcoin on the main chain.
Industry Implications
This breach highlights a systemic vulnerability in sidechain peg mechanisms, where a single software flaw can decouple a token from its underlying asset. The incident caused a temporary collapse of the L-BTC peg, with backing dropping to as low as 4.7%. Because numerous exchanges rely on the Liquid Network for settlement, this instability threatened the broader operational reliability of the network's participants.
Recovery and Response
The attackers identified themselves as "white-hats" and have since returned approximately 3,400 BTC, or 85% of the stolen funds. However, they continue to hold roughly 600 BTC, valued at approximately $47 million. Blockstream has stated it is collaborating with law enforcement, cryptocurrency exchanges, and forensic specialists to recover the remaining assets. It remains unconfirmed whether a settlement will be reached with the attackers or if the remaining funds will be recovered through legal and technical intervention.