Tuesday, September 8th, 2026 — Liquid Network halted new transactions after purported white-hat hackers removed roughly 4,000 bitcoin from a federation wallet holding about 4,200 bitcoin, an incident valued at approximately $320 million. The Bitcoin sidechain is used by cryptocurrency exchanges and other financial firms to settle transactions more quickly than on Bitcoin’s main blockchain.
Blockstream, which launched Liquid in 2018, attributed the incident to a software bug in Elements rather than stolen passwords, private keys or compromised hardware modules. Liquid is overseen by a federation of more than 80 exchanges, infrastructure companies and asset managers.
The affected bitcoin moved through SideSwap, an approved trading platform on the network. Blockstream determined that a software flaw had created some of the bitcoin involved. SideSwap said it could not distinguish bitcoin generated through the flaw from legitimate coins and therefore treated them alike. Other assets operating on Liquid were not affected.
The person or group responsible has described the operation as white-hat activity and reportedly communicated with network maintainers through messages embedded in Bitcoin transactions. One message said the funds would be returned after the vulnerability was fixed and every node was patched. Liquid had not announced when transactions would resume or confirmed that the bitcoin would be returned.
For cyber claims professionals, the reported cause is a significant detail in evaluating the event. The loss was attributed to a software defect rather than credential theft or compromised cryptographic keys, while the resulting shutdown also disrupted normal network operations. Those facts could affect how insurers and insureds examine the mechanism of loss, affected systems, recovery efforts and any resulting business interruption under applicable policy language.
The prospect of recovering the bitcoin also remains unresolved. A promise from a purported white-hat hacker to return assets does not establish that recovery will occur. Claims investigations involving similar digital-asset incidents may need to distinguish the initial value of assets removed, amounts ultimately recovered and separate losses associated with interrupted operations.
