Liquid Network: 4,000 BTC Stolen via Elements Bug, 3,400 Returned After On-Chain Negotiation
> TL;DR: On September 6, 2026, a withdrawal of roughly 4,000 bitcoin — about $320 million at the time, 95% of Liquid Network's reported reserves (about 4,200 BTC) — left the federation wallet via SideSwap's Peg-out Authorization Key. The L-BTC used to trigger that peg-out had been created by exploiting a bug in Elements, the software Liquid runs on. The network has been paused since. The next day, the group — describing itself as white hats — returned 3,400 BTC after a negotiation conducted publicly on the blockchain; about 598.5 BTC ($47 million) remains in its possession. Ledger's CTO calls it extortion.
Timeline
September 6: a massive peg-out drains the federation. A peg-out destroys L-BTC on the sidechain and releases matching bitcoin on the main chain. The exit went through SideSwap's Peg-out Authorization Key — but neither that key nor SideSwap's systems were compromised: the problem was upstream.
The entry point: a bug in Elements, the open-source software running Liquid, allowed creating the L-BTC used in the withdrawal. In other words, backing tokens were fabricated without real bitcoin behind them, then converted through the standard mechanism. Blockstream, which provides Liquid's technology, has not detailed the flaw.
September 7: the two sides talk through transactions. An early on-chain message reads "we are whitehats. contact us on chain." The group demanded the flaw be fixed and every node patched before returning anything. Blockstream replied with a signed message confirming its bridge nodes were patched. A 1,000-satoshi transaction carrying a PGP-encrypted message preceded the 3,400 BTC transfer to the federation address by 38 minutes.
September 8 onward: about 598.5 BTC has not come back — it is the change from that same transaction, still sitting at the originating address. Blockstream is preparing a coordinated federation restart and asks users not to send funds to peg-in addresses until confirmed. Other assets issued on Liquid (USDT, DePix) are unaffected.
Why this matters to you
No HR SaaS runs on Liquid, but the pattern is universal: a critical open-source component (Elements) carried a flaw that allowed forging trusted assets, and the loss hit $320 million within hours. Most SaaS products rest on exactly this model — open-source dependencies entrusted with a security property (signatures, quotas, isolation, encryption) that nobody re-verifies internally. The question to ask is simple: which component of your stack, if it misbehaved, would break a guarantee you advertise to customers? And when was it last audited?
What to do
The broader lesson
The negotiation happened through messages embedded in transactions and encrypted with PGP — an improvised settlement protocol on a public blockchain, with no legal frame. Spectacular, but the real subject remains the Elements bug: a quiet software flaw in a trust brick moved the equivalent of $320 million. The security of your software guarantees cannot be delegated to a README, even a reputable one.
Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Revolut: Passports, KYC Selfies, and Bitcoin History Handed to an Attacker Impersonating a Government Agency
Revolut (80+ million customers) has notified a data breach: an attacker requested personal data by email from a government agency's domain, with valid domain authentication credentials. Copies of passports, facial verification selfies, IBAN statements, and complete transaction history (including Bitcoin) were disclosed. Suspected targeting of high-net-worth users per ZachXBT.
Brevo Hacked: Trezor Phishing Sent from help@trezor.io, 347,000 Emails Targeted
On September 9, 2026, an unauthorized actor accessed French email platform Brevo (formerly Sendinblue), compromising 120 customer accounts including Trezor's. Fake security alerts went out from the genuine help@trezor.io address to 347,000 subscribers; 2,500 people clicked the malicious link before the domain was taken down in 20 minutes.
ColdCard PRNG flaw: how a firmware bug led to a $70 million Bitcoin heist in 41 minutes
A March 2021 firmware integration error in ColdCard hardware wallets routed seed generation to a deterministic software PRNG instead of the hardware RNG. On July 30, 2026, an attacker swept 1,082 BTC ($70M+) from 1,196 addresses in 41 minutes. Emergency firmware shipped July 31 — but it does not repair existing seeds.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.