The Liquid Network Hack: Anatomy of a $320M Bridge Bug

The 35 minutes that emptied a Bitcoin sidechain

On September 6, 2026, someone withdrew roughly 4,000 BTC, about $320 million at the time, from the Liquid Network. They did it without stealing a private key, without phishing an engineer, and without persuading a single one of the network’s signers to approve anything they were not already programmed to approve. Blockchain analytics firm Chainalysis, which reconstructed the attack, described a withdrawal that looked, to the software checking it, completely valid. It was not.The core drain took about 35 minutes, from a forged token mint to the peg-out that swept Liquid’s reserve down to a few hundred coins, according to an on-chain timeline compiled by Bitquery. That makes it the largest cross-chain bridge exploit of 2026, edging past April’s $292 million KelpDAO hack and standing well above the running bridge-loss tallies that PeckShield tracked through the spring. It is also the cleanest proof yet of a thesis this desk has repeated all year: bridge security is not a question of how many signers guard the vault, but of whether what those signers verify is actually true. Liquid is only the newest entry in a run of bridge hacks that keep repeating, and it repeats the oldest lesson of all.This is a forensic account of what happened, how the money moved, why the people who signed the fraudulent withdrawal were not compromised in any conventional sense, and what a consensus-layer bug on an eight-year-old federated sidechain tells us about the security of every bridge still standing. Bitcoin itself was trading in the low $80,000s on the day this piece went out, so the roughly 600 BTC still unreturned is worth close to $47 million; the human dispute over those coins turned out to be almost as instructive as the code.

What Liquid is, and why a peg is a bridge

The Liquid Network is a federated Bitcoin sidechain built and operated by Blockstream, live since 2018. Users lock BTC on the Bitcoin base layer and receive Liquid Bitcoin (L-BTC) on the sidechain at a one-to-one rate; to leave, they burn L-BTC and the federation releases the equivalent BTC back on Bitcoin. The appeal is faster, confidential settlement for exchanges and traders. The catch is the same catch every bridge carries: the moment your BTC is locked, the thing you actually hold is an IOU whose value depends entirely on the honesty and the code of whoever controls the lock.On Liquid, that control sits with a federation of roughly fifteen functionaries, hardware devices run by exchanges and companies in the ecosystem. Peg-outs, the withdrawals that release real Bitcoin, require a threshold signature, 11 of the 15 functionaries, before coins leave the federation wallet. That federation is the bridge. The peg is not a metaphor for a bridge; it is one, a two-way crossing between two ledgers with a multisig standing at the gate. And like every bridge, its weakest point is not the strength of the lock but the truthfulness of the message that tells the lock to open.Liquid also runs Confidential Transactions, a feature that hides the amounts and asset types moving on the sidechain behind cryptographic range proofs. A range proof is a small piece of math that lets a node confirm a hidden number is not negative without revealing the number itself. That matters because a negative or fabricated amount is how you print money out of nothing. The entire security of a confidential ledger rests on those proofs being checked correctly, every time, on every node. The 2026 hack lived exactly there, in the checking.

The bug: a cache that could not tell two proofs apart

Verifying a range proof is expensive, so Elements, the Bitcoin-derived software that powers Liquid, caches the result. Once a proof has been checked and found valid, the node stores that verdict keyed to the proof so it never has to redo the work if the same proof shows up again. Caching a true answer is harmless. Caching it under a key that two different inputs can share is not.According to Bitquery’s teardown, the cache key was built by concatenating four values with no delimiters between them: the proof itself, the hidden amount commitment, the hidden asset, and the output script. Nothing marked where one value ended and the next began. Because several of those fields are variable in length, two genuinely different sets of inputs could be glued together into the exact same string of bytes, producing a cache-key collision. A second, invalid proof could then be waved through on the strength of a first, valid one that happened to hash to the same key. Chainalysis put the mechanism plainly: the attackers exploited the system by first getting valid data verified and cached, then submitting different, invalid data that pointed to the same cached result.The attacker did the boring part first. Bitquery found that an identical range proof was planted 68 times across roughly 14 hours, spanning Liquid blocks 4,049,384 to 4,050,246, seeding the poisoned verdict into every node’s cache. Then, at 13:53 UTC in block 4,050,336, they used a forged proof that collided with the cached entry to mint roughly 4,000 unbacked L-BTC out of thin air. The confidential-transaction feature that was supposed to protect users’ privacy also hid the exact size of the fraudulent mint from casual observers while it happened. From there it was a short walk to the exit.

A multisig that signed a lie

At 14:28 UTC, about half an hour after the mint, the attacker initiated a peg-out and the federation released real Bitcoin. Bitquery’s numbers show the reserve falling from 4,205.29 BTC to 202.63 BTC in a single sequence, roughly 95% of everything backing the network gone. The 11-of-15 threshold did exactly what it was designed to do. The functionaries signed because their software told them the L-BTC being redeemed was real, fully backed, and eligible to leave. By the internal logic of the machine, it was a routine withdrawal.This is the part that should keep bridge designers up at night. Nobody bribed the signers. Nobody stole their keys. Nobody had to. The honest majority verified a falsehood, faithfully, because the falsehood had been laundered through the consensus layer before it ever reached them. A quorum protects you against dishonest or compromised participants. It does nothing against a shared bug that makes every honest participant believe the same wrong thing at the same time.Ben Fisch, chief executive of Espresso Systems, gave the canonical description of this failure mode after the KelpDAO hack in April, and it fits Liquid almost word for word. Most bridges, he told CoinDesk, do not fully verify what happened on another chain; they rely on a smaller system to report it. When that smaller system is wrong, the result is not a broken bridge but a lying one. In his words, the bridge worked as designed. It just believed the wrong information. KelpDAO’s attackers achieved that by feeding forged data to a single verifier node. Liquid’s achieved it by corrupting a cache the whole federation trusted. Different vector, identical outcome: a signature over a lie.

Timeline: the drain, the halt, the return

The incident moved from theft to negotiation to partial recovery in less than a week. The compressed timeline below is drawn from Bitquery’s on-chain reconstruction and contemporaneous reporting by Bitcoin.com and The Block.

Date (UTC)	Event
Aug to early Sep	A fix for the range-proof cache bug is written, reviewed, and merged into the public Elements codebase; the federation keeps running an older build
Sep 6, 13:53	Forged mint of roughly 4,000 unbacked L-BTC in block 4,050,336
Sep 6, 14:28	Peg-out drains the federation reserve from 4,205 to about 203 BTC
Sep 7, early hours	Blockstream detects the shortfall, halts Liquid block production, and posts on-chain messages to the attacker
Sep 7, 16:09	Attacker returns 3,400 BTC (about 85%) to the federation wallet
Sep 9, 03:14	Blockstream ships Elements v23.3.4, hardening the range-proof cache keys
Sep 10	Block production resumes; peg-outs stay cautious over the shortfall
Sep 11	Blockstream publicly refuses to pay a bounty for the roughly 598.5 BTC still outstanding

Two things stand out from that sequence. First, the money left and most of it came back inside 24 hours, which is unusual and, as we will see, contested in its meaning. Second, the fix was not invented in a panic after the theft. It already existed.

The fix that existed before the theft

Blockstream’s emergency patch, Elements v23.3.4, rebuilds the cache key so that the four values inside it can no longer run together, prepending each value’s length before the value itself so boundaries are unambiguous, and it adds an option to disable the range-proof cache entirely. It is a small, correct fix for a small, catastrophic ambiguity. The uncomfortable detail is the timing: the underlying correction to the caching logic had already been written and merged into the public Elements repository before the funds moved, while the federation itself was still running a build that predated it by months.That is the N-day problem in its purest form. A public commit is a roadmap. Anyone reading the repository’s history can see what changed, reason backward to the vulnerability the change closes, and check whether the systems holding real money have actually deployed it yet. A security review of the codebase before the incident, as one post-incident analysis noted, would have shown a fix that was written, reviewed, merged, and marked done on every dashboard; what nobody produced was the second half, a demonstration that counterfeit L-BTC could no longer be minted and redeemed end to end while the released builds in production were still vulnerable. The gap between a merged fix and a deployed one is precisely where value leaks out of this industry, over and over.It is worth being precise about what kind of attack this was, because the vocabulary matters. The attacker did not need hashpower, did not need to out-mine the network, and did not mount anything resembling the classic 51% attack on Bitcoin that people usually picture when they hear the phrase consensus attack. They exploited a defect in the consensus code itself. A bug did the work that a majority of hashpower would otherwise have to do, and it did it for free. That is a far cheaper and far more repeatable path to the same end, and it is why implementation quality, not just decentralization, is a security property.

The disclosure war: red team versus Blockstream

If the fix existed beforehand, the obvious question is whether anyone had warned Blockstream to ship it. That question became a public fight. Calle, a co-lead of a group calling itself the Bitcoin Red Team, claimed his researchers had flagged the vulnerability to Blockstream before the exploit and that the warning went unheeded. He summarized the episode in a line that spread quickly through Bitcoin circles: it apparently cost 600 BTC to ignore an email from the red team, a pointed reference to the roughly 600 coins the attacker kept. Samson Mow, Blockstream’s former chief strategy officer, pushed back just as bluntly, saying no emails were ignored. The two accounts have not been reconciled, and the Red Team has said it will publish a full timeline of its disclosure process once Blockstream releases a formal post-mortem, per reporting from Bitcoin.com.Set aside who is right about the specific email. The structural problem is the same one that dogs coordinated vulnerability disclosure across all of crypto. When a fix is merged silently, without a security advisory, the people who most need to know the systems holding money are exposed, the operators, the auditors, the users, are the last to hear about it, while anyone watching commit diffs is the first. Established practice in mainstream software security, from vendor advisories to the safe-harbor and 90-day-window norms that groups like the Security Alliance have tried to import into DeFi, exists precisely to shrink that window. A federated bridge holding hundreds of millions of dollars is the last place a silent fix belongs, whoever was or was not warned.

White hat or theft? Blockstream draws a line

The attacker insisted throughout that this was a rescue, not a robbery. On-chain messages left in Bitcoin’s OP_RETURN field addressed Blockstream directly, warning that the chain is under risk at latest commit and to make sure every node is patched, and promising to return the funds once the bug was fixed. They also asked for a fee: a 10% bounty on the drained amount, and they framed the whole exercise as exposing negligent security, claiming Blockstream had spent only about $1.5 million to secure some $5 billion in assets, as recounted in Bitcoin.com’s account of the standoff.Blockstream refused the framing entirely. In a statement on September 11, reported by The Block, the company said that taking assets without authorization and withholding their return is a crime, not responsible disclosure, that it is not white-hat activity, and that it is theft. The company added that it would not pay for the return of stolen property, would not abandon its users, and that the Bitcoin community would not stop pursuing the funds. Charles Guillemet, chief technology officer of hardware-wallet maker Ledger, was blunter still, telling BeInCrypto that white hats do not drain a bridge and then solicit an on-chain contact, and comparing the pattern to the Ronin and Euler thefts rather than to any legitimate security test.The genre they are disputing does exist. When Poly Network lost more than $610 million in 2021, the team addressed the attacker as Mr. White Hat, offered a bounty, and recovered nearly everything within about two weeks, as CNBC documented at the time. The difference is consent and sequence. A genuine white hat discloses privately, lets the operator patch, and never moves the funds without permission. Draining first and negotiating after inverts that order, and it hands the operator an impossible choice: reward the behavior or eat the loss. Blockstream chose to eat the loss.

Keys, code, and now consensus

Step back from Liquid and the shape of bridge failure comes into focus. TRM Labs, in its first-half 2026 report, found that infrastructure, key, and operational compromises made up only about 15% of hacking incidents but roughly 76% of the value stolen. Most of the headline bridge disasters were never Solidity bugs at all. They were stolen keys, forged signatures, or corrupted infrastructure. Liquid adds a rarer and in some ways more alarming category: a pure defect in the consensus verification code, the layer everyone assumes is the bedrock.

Incident	Year	Approx. loss	Failure class	Trust model
Ronin	2022	$625M	Stolen validator keys	Federated multisig
Poly Network	2021	$610M	Privileged-call abuse	Contract logic
Wormhole	2022	$325M	Forged signature (VAA)	External guardians
Liquid Network	2026	$320M	Consensus verification bug	Federated peg
KelpDAO	2026	$292M	Forged cross-chain message	Attestation network
Nomad	2022	$190M	Init or upgrade bug	Optimistic
Multichain	2023	$130M+	Operator collapse	MPC or operator

Read down the failure-class column and the diversity is the point. Ronin fell to stolen keys, the largest bridge hack on record at roughly $625 million per CoinDesk. Wormhole fell to a forged validator approval that Jump Crypto quietly backstopped, per Halborn’s post-mortem. Nomad fell to a blank trusted root that turned into a crowdsourced free-for-all Mandiant memorably called decentralized robbery. Multichain did not get hacked at all in the usual sense; it collapsed when the one person holding its keys was detained. There is even a distinct AMM-style variant, the kind of same-block manipulation that flash loans make cheap, which is how Allbridge was drained twice. A bridge can break in a dozen unrelated ways, and building against one of them buys you nothing against the other eleven.

Why more signers would not have saved Liquid

Here is the counterintuitive core of the whole incident. The instinct after any bridge hack is to demand more signers, higher thresholds, a bigger, more decentralized committee. For some failures that instinct is correct. Ronin was compromised because an attacker obtained 5 of 9 validator keys; a larger, more independent, harder-to-reach signer set genuinely would have raised the cost of that attack. Key theft and collusion are exactly the risks a threshold is built to resist.Liquid is the opposite case. Its 11-of-15 functionaries were not compromised. They ran the same Elements software, which contained the same cache bug, and so they all independently reached the same false conclusion that a forged proof was valid. Raising the bar to 15 of 15 would have changed nothing. A hundred signers would have changed nothing, as long as every one of them ran the identical buggy verifier. This is correlated failure, and a threshold is powerless against it, because a threshold assumes the signers fail independently. When the flaw lives in the shared code they all trust, they fail together, unanimously, and on time.The defense that actually addresses this is not a bigger committee but a more diverse one: multiple independent implementations that would have to share the identical bug to be fooled together, the software equivalent of client diversity in Ethereum’s validator set. That is the logic behind the newer defense-in-depth designs, from stacked and heterogeneous verifier networks to the N-version programming approach in Chainlink’s risk-management layer, where independent codebases cross-check each other so a single implementation defect cannot mint fake money uncontested. Liquid did not have that redundancy. Almost no federated bridge does.

The recovery: 85% back, and a peg to defend

By September 7, the attacker had returned 3,400 BTC, roughly 85% of the haul, keeping about 598.5 BTC as a self-declared bounty, a figure confirmed across CoinDesk and Chainalysis. Blockstream resumed block production on September 10 and moved to reassure holders that the shortfall would not fall on them. Chief executive Adam Back urged the community not to panic sell L-BTC over the counter and said the peg with Bitcoin would be covered one to one, so that users could still redeem L-BTC for the equivalent amount of Bitcoin, according to Bitcoin.com. In practice, Blockstream was choosing to absorb the roughly $47 million gap rather than pass it to L-BTC holders or pay the attacker to close it.That outcome, most of it back plus a backstop for the rest, put Liquid in the middle of a very wide range of endings. Recovery in bridge hacks is a lottery, decided less by law than by who happens to be standing behind the protocol and what the attacker decides to do. The table below sets Liquid against the other landmark cases.

Incident	Approx. loss	Recovery outcome	Who ultimately paid
Wormhole	$325M	Fully backstopped within a day	Jump Crypto
Poly Network	$610M	Nearly all returned by the attacker	Attacker (negotiated)
KelpDAO	$292M	Backing rebuilt by a coalition	DeFi United (Aave, Mantle, others)
Liquid Network	$320M	85% returned; the rest covered	Attacker plus Blockstream
Harmony	$100M	Mostly unrecovered	Users, largely absorbed
Multichain	$130M+	Unresolved; liquidation proceedings	No one made whole

KelpDAO is the instructive contrast on the good end: after its $292 million loss, a coalition of protocols branded DeFi United rebuilt the backing for rsETH over about five weeks so that no losses passed to users, as Incrypted reported. Harmony and Multichain are the bad end, where the money simply never came back. Notice what none of these endings involved: an insurer, a deposit-guarantee scheme, or a court order that produced the funds on demand. Every recovery here depended on either the attacker’s goodwill or a wealthy party choosing to eat the loss. That is not a safety net. That is charity and negotiation wearing the costume of one.

Where the money can go, and why the SEC cannot claw it back

The roughly 600 BTC still outstanding is not lost to the void. It is Bitcoin sitting on the base layer, pseudonymous but permanently visible, and if the holders ever want to turn it into spendable value they run into the same choke points every thief now faces. The laundering economics have shifted: analytics firm Global Ledger found that cross-chain bridges overtook mixers as the single largest laundering channel in 2025, handling around $2 billion, or roughly half of all traceable stolen funds, in its financial-crime review. The irony is heavy. The same cross-chain plumbing that lost the money is also the preferred rail for moving it once it is stolen.The regulatory tools aimed at those rails are in flux. The Treasury sanctioned the Tornado Cash mixer in 2022, a federal appeals court found in 2024 that the sanction exceeded the government’s authority over immutable smart contracts, and Treasury delisted it in March 2025, a reversal Forbes covered in detail. The newer teeth are aimed not at protocols but at the on and off ramps: correspondent-banking chokepoints and travel-rule enforcement of the kind that hit the Huione network under Section 311. Sanctioning code has proven legally fragile; cutting a laundering service off from the banking system has proven durable.For an American reader wondering where the SEC fits, the honest answer is that it mostly does not. The SEC regulates securities offerings and the intermediaries around them; it does not run a fund that reimburses victims of a consensus bug on a Bitcoin sidechain, and there is no equivalent of deposit insurance or a chargeback here. When protocols do recover money through the legal system, it is slow and self-funded: Bybit, after its record 2025 theft, sued the North Korean actors behind it and won a preliminary asset freeze, but that is a company spending its own money to chase its own coins, not a regulator making anyone whole. The same property that makes a bridge hard to secure, that no single operator controls the outcome once code is deployed, is what makes it hard to police afterward.

What Liquid changes about Bitcoin sidechain trust

Liquid never pretended to be trustless. A federation is an explicit, honest statement of its trust model: you are trusting fifteen named functionaries and the code they run. The hack did not break the federation’s honesty. It broke the code the honest federation relied on, which is a subtler and more dangerous kind of failure, because it turns a transparent trust assumption into a hidden one. The functionaries were trustworthy. The verifier was not, and no one could see it from the outside.That should recalibrate how people talk about Bitcoin’s expanding set of layers and pegs. Federated sidechains like Liquid, optimistic and BitVM-style designs, and the various staking and restaking systems that secure other networks all move trust around; none of them delete it. Even projects that avoid the sidechain label entirely, like the Bitcoin-staking approach we examined in our look at why Babylon is not a Layer 2, are ultimately asking users to accept some new assumption in exchange for new functionality. Vitalik Buterin made the general case years ago and it has aged well: there are, he argued, fundamental limits to the security of bridges that hop across multiple zones of sovereignty. Liquid is one more data point that he was describing a law, not a temporary state of the art.The practical takeaways are not exotic. Implementation diversity matters as much as signer count, because a shared bug defeats any threshold. Wrapped IOUs are honeypots, so native issuance and burn-and-mint transfers that never pool custody are safer where they exist. Stacked, heterogeneous verifiers beat a single trusted reporter. And for an individual, the plainest lesson holds: any peg or bridge is a live counterparty, not a neutral pipe, so hold bridged assets only as long as you actually need them, and size that exposure to a loss you could survive. Liquid’s users mostly walked away whole this time because Blockstream had the balance sheet and the will to cover a $47 million hole. The next federation to sign a lie may not.

Frequently Asked Questions

How much was stolen in the Liquid Network hack, and how much came back?

An attacker drained roughly 4,000 BTC, about $320 million at early-September prices, from the Liquid Network on September 6, 2026. Within about a day the attacker returned 3,400 BTC, close to 85% of the total, and kept around 598.5 BTC, worth about $47 million, as a self-declared bounty. Blockstream refused to pay for the rest and said it would cover the shortfall so that L-BTC holders could still redeem at one to one.

Was the Liquid Network hack a private-key theft?

No. No private keys were stolen and no signer was compromised. The attacker exploited a bug in the Elements software that powers Liquid, where a caching flaw in range-proof verification let two different inputs share the same cache key. That let a forged proof be accepted as valid, so the attacker minted unbacked L-BTC and then redeemed it. The federation multisig signed the withdrawal because its software wrongly reported the tokens as fully backed.

Was Bitcoin itself affected, or only Liquid?

Only Liquid was affected. Liquid is a separate federated sidechain that holds Bitcoin in reserve and issues L-BTC against it. The bug lived in Liquid’s own software, not in Bitcoin, and the Bitcoin base layer was never at risk. What broke was the peg’s backing on Liquid, which is why Blockstream halted the sidechain rather than anything on Bitcoin.

Were the Liquid attackers really white hats?

That is disputed. The attackers called themselves white hats, left on-chain messages urging Blockstream to patch, and returned most of the funds, but they drained the reserve first and then demanded a 10% bounty. Blockstream called it theft rather than responsible disclosure, and Ledger chief technology officer Charles Guillemet argued that genuine white hats do not drain a bridge and then solicit contact on-chain. A true responsible disclosure reports the bug privately and never moves user funds without permission.

Can the SEC or law enforcement recover the stolen Bitcoin?

There is no reliable mechanism that forces the funds back. The SEC oversees securities offerings and intermediaries, not consensus bugs on a Bitcoin sidechain, and there is no deposit insurance or chargeback for this kind of loss. Recovery in past bridge hacks has depended on the attacker returning funds, a wealthy backer covering the gap, or slow civil litigation such as Bybit suing the actors behind its 2025 theft. In Liquid’s case the outstanding coins are traceable on-chain but not compelled back.By Marcus Feld, HOGE Wire security desk.

More from this desk

Guessed, Not Stolen: Crypto’s Weak-Key Problem in 2026

Sep 20, 2026

Twice Is a Pattern: Why Bridge Hacks Keep Repeating in 2026

Sep 19, 2026

Zero Bugs Found: Halborn and the $292M Kelp DAO Hack

Sep 18, 2026