Liquid Network (Blockstream) (2026) — Crypto Hack
Partially RecoveredBlockstream's Liquid Network Bitcoin sidechain federation wallet was drained of ~$320M (~4,000 BTC) via the SideSwap Peg-out Authorization Key (PAK) mechanism / an Elements node software bug, with purported white-hat actors involved. The network was paused and exchanges halted L-BTC deposits and withdrawals. On September 7, 2026, ~3,400 BTC (~$272M) was returned, leaving ~602 BTC (~$47M) still outstanding.
Summary
Blockstream's Liquid Network Bitcoin sidechain federation wallet was drained of ~$320M (~4,000 BTC) via the SideSwap Peg-out Authorization Key (PAK) mechanism / an Elements node software bug, with purported white-hat actors involved. The network was paused and exchanges halted L-BTC deposits and withdrawals. On September 7, 2026, ~3,400 BTC (~$272M) was returned, leaving ~602 BTC (~$47M) still outstanding.
How It Was Compromised — Sidechain via Federation Wallet Drain / Elements Node Bug (Peg-out Authorization Key)
On September 6, 2026, the Liquid Network — Blockstream's Bitcoin sidechain — suffered a drain of approximately $320 million (~4,000 BTC) from its federation wallet. The attack exploited the SideSwap Peg-out Authorization Key (PAK) mechanism combined with an Elements node software bug, allowing the federation wallet to be drained. The actors involved were purported to be white-hat operators. In response, the Liquid Network was paused and multiple exchanges halted L-BTC deposits and withdrawals. On September 7, 2026, approximately 3,400 BTC (~$272M) was returned to the federation, leaving roughly 602 BTC (~$47M) still outstanding as recovery efforts continued.
Fund Flow & Laundering Analysis
The bulk of the drained BTC (~3,400 BTC, ~$272M) was returned on September 7, 2026, consistent with the purported white-hat nature of the actors. Approximately 602 BTC (~$47M) remained outstanding, with the network pause limiting observable laundering activity.