On Sunday, September 6, 2026, unknown threat actors exploited a vulnerability in the Liquid Network Bitcoin sidechain, stealing approximately 4,000 bitcoin. By Monday, September 7, 2026, the actors returned 3,400 bitcoin via blockchain analysis. Approximately 598.5 bitcoin, valued at around $47 million at current market rates, has not been returned. The Liquid Network remains paused, preventing holders from redeeming L-BTC tokens for bitcoin. The incident is attributed to unknown threat actors; the root cause and exploitation method remain unconfirmed.

What should defenders do?

Liquid Network operators have paused the sidechain to mitigate further loss and allow for investigation. Holders of L-BTC tokens are advised to refrain from attempting redemption until the sidechain resumes operations and the vulnerability is addressed. Stakeholders should monitor official Liquid Network channels and trusted cybersecurity sources for updates on the patch, root cause analysis, and restoration timeline. No public patch has been released as of the latest reporting.

highCyber Attacks

Liquid Network Sidechain Hackers Return 3,400 Bitcoin, ~598.5 BTC Still Missing

Approximately $47 million in bitcoin remains unaccounted for after threat actors returned the majority of stolen funds; network remains paused

CyberIntel DeskPublished 20 days agoUpdated less than a minute ago1 min read

Liquid Network Sidechain Hackers Return 3,400 Bitcoin, ~598.5 BTC Still Missing

Key Takeaways

Approximately 4,000 bitcoin were stolen from the Liquid Network sidechain on September 6, 2026.
3,400 bitcoin were returned by the threat actors on September 7, 2026.
Around 598.5 bitcoin, estimated at $47 million, remains missing.
The Liquid Network remains paused, blocking L-BTC token redemption for holders.

Related Security News

highCyber Attacks

Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.

BleepingComputerabout 5 hours ago1 min read