# Liquid Network (Blockstream) LBTC exploit: Liquid bug let attackers mint ~4,000 unbacked LBTC and drain ~4,000 BTC; full backing later restored Source page: https://vaultx.llc/hacks/liquid-network-exploit-september-2023 · VaultX incident report by Sentinel · first published 2026-11-03, updated 2026-11-03 - Date: 2023-09-06 - Reported loss: $320M (Reported gross withdrawal of about 4,000 BTC, roughly $320M at the time. About 3,400 BTC (about $269M) was reportedly returned the next day. The net shortfall was about 598-600 BTC, often described as roughly $47M. Exact dollar values depend on the BTC price used.) - Attribution: Unknown / unconfirmed. According to reporting, the actors told Blockstream they were 'white-hat' hackers. No named person or group has been publicly identified in the available coverage. - Chains: Liquid Network (Bitcoin sidechain / federation, Elements software), Bitcoin - Status: resolved - Severity: 72/100 - Response score: 68/100 (Exchanges were notified quickly, negotiations led to a return within about a day, and full backing was restored in about two months. Against that, there was no compensation fund and no named attacker, and users reportedly faced long restrictions on moving funds out.) According to reports, an attacker exploited a bug in the Elements-based software behind Liquid Network on Sept. 6, 2023. The bug let them create about 4,000 LBTC with no BTC behind it and redeem it for about 4,000 BTC (about $320M) from the federation wallet. The reserve reportedly fell from about 4,205 BTC to 197 BTC. About 3,400 BTC was reportedly returned the next day, leaving a gap of about 598-600 BTC. Later coverage says full 1:1 backing was restored after a final 250 BTC transfer. **What happened** On Sept. 6, 2023, Liquid Network was hit by an exploit that, according to reports, let an attacker mint and redeem unbacked LBTC. LBTC is Liquid's bitcoin-backed token on the Liquid sidechain. About 4,000 BTC was drained from the federation wallet, which reportedly cut the reserve from about 4,205 BTC to 197 BTC. The actors reportedly communicated with Blockstream through PGP-signed messages embedded in Bitcoin transactions and later described themselves as 'white-hat' hackers. Some headlines say they kept about $47M for themselves. On Sept. 7, 2023, about 3,400 BTC (about $269M at the time) was reportedly returned after on-chain contact and negotiations, according to Blockstream's incident assessment. That left a net shortfall of about 598-600 BTC. Reports differ slightly between 'about 598 BTC' and 'almost 600 BTC'. Over the following weeks BTC-LBTC swaps were reportedly restored through participating providers such as SideSwap, while direct federation withdrawals stayed under enhanced controls. Reports then say Liquid restored full 1:1 backing about two months after the exploit, once a final 250 BTC transfer closed the remaining gap. **How it worked** Reports say a vulnerability in the Elements-based code underlying Liquid allowed the creation of about 4,000 LBTC without real BTC being locked first. Those unbacked LBTC were then redeemed for real BTC held in the federation wallet. Reporting says the withdrawal route involved SideSwap, a settlement platform allowed to handle Liquid withdrawals. Blockstream reportedly said the key used in the withdrawal process was not compromised and that the problem was the software vulnerability itself. This was a protocol and software flaw, not a stolen-key theft, according to that account. **Where the money went** According to reports, about 4,000 BTC left the federation wallet. About 3,400 BTC was returned to the federation the next day. The remaining roughly 600 BTC was reportedly kept by the actors, and one report says they had not moved those funds. The gap in backing was later closed by funding from the federation or treasury side, including a final 250 BTC transfer. The sources do not name who supplied that funding. They document no mixer, bridge or exchange routing and no freezes by exchanges or law enforcement. SideSwap is reportedly part of the withdrawal route. **The response** According to Blockstream's incident assessment, exchanges were notified to pause LBTC deposits and withdrawals. The team made on-chain contact with the attacker, which led to the return of 3,400 BTC on Sept. 7. Block production reportedly resumed afterwards. BTC-LBTC swaps were restored through participating providers while direct federation withdrawals stayed under enhanced controls, with a planned controlled reactivation of peg-outs for authorized PAK key holders. Full 1:1 backing was reportedly restored about two months after the exploit. The available reporting shows no user compensation fund, no named insurance fund, and no public police or regulatory action. **Impact** For a time LBTC was reportedly under-collateralized, since the reserve had dropped to about 197 BTC against roughly 4,200 BTC of LBTC. Users reportedly had to find costlier ways to exit Liquid until the peg was restored. The available sources give no verified price chart or measured price move for BTC or LBTC. User funds were reportedly made whole through the restored backing rather than through a separate compensation scheme. **Timeline** - 2023-09-06 Exploit of the Elements-based Liquid software; about 4,000 unbacked LBTC minted and redeemed for about 4,000 BTC. Blockstream reportedly notified exchanges to pause LBTC deposits and withdrawals. - 2023-09-07 About 3,400 BTC reportedly returned after on-chain contact and negotiations, leaving a shortfall of about 598-600 BTC. - 2023-09 Late September: Bull Bitcoin reportedly said its customers could not convert LBTC back to BTC on its platform. - 2023-10 Late October: BTC/LBTC swaps reportedly resumed via participating providers such as SideSwap, with direct federation peg-outs still restricted. - 2023-11 Early November (reports dated Nov. 2-3): Liquid reportedly restored full 1:1 backing for LBTC after a final 250 BTC transfer. **How to protect yourself** - Sidechain and federation tokens such as LBTC are IOUs. Their value depends on the reserve and on the integrity of the software that governs minting and redemption, not only on key security. - Check proof-of-reserves or backing status before holding large balances in a wrapped or pegged asset, and keep an exit path that does not depend on a single provider. - Builders should audit inflation and minting logic in forked or shared base code, and should have emergency pause procedures and exchange notification channels ready. - A self-declared 'white-hat' claim does not confirm intent. The net loss of about 600 BTC and the unrecovered funds show the exploit was not fully benign. - Projects should disclose who covered any shortfall and how. **Still unknown** - The identity of the attackers is not publicly established; 'white-hat' is a self-description. - No attacker wallet addresses appear in the available material. - Who funded the final 250 BTC transfer is not stated in the sources, and neither is the source of the other funds that filled the gap beyond the 3,400 BTC returned. Whether the actors kept the roughly 600 BTC or it was settled in some other way is also unclear. - The net shortfall is reported variously as about 598 BTC or almost 600 BTC, and dollar values depend on the BTC price used. - Some source URLs carry 2026 dates while the reporting text describes 2023 events. The exact publication dates of the restoration coverage should be verified against primary sources. - Whether any regulator or law enforcement inquiry exists is not shown in the available sources. **Sources** - Blockstream/Liquid: Liquid Network security incident assessment https://blog.liquid.net/liquid-network-security-incident-assessment/ - CoinDesk: Liquid's bitcoin IOUs are fully backed again after a $320 million exploit https://www.coindesk.com/markets/2026/11/03/liquid-s-bitcoin-ious-are-fully-backed-again-after-a-usd320-million-exploit - Yahoo Finance / Reuters: Liquid Network restores full bitcoin backing https://finance.yahoo.com/markets/crypto/articles/liquid-network-restores-full-bitcoin-112210757.html - News.Bitcoin.com: Liquid Network restores its bitcoin reserves https://news.bitcoin.com/blockchain/good-news-finally-liquid-network-restores-its-bitcoin-reserves/ - Reuters: Bitcoin-based Liquid Network says $320 million withdrawn in hack https://www.reuters.com/technology/bitcoin-based-liquid-network-says-320-million-withdrawn-hack-2026-09-07/ - Chainalysis: $320M exploit of Liquid Network https://www.chainalysis.com/blog/320m-exploit-liquid-network/ - Gizmodo: Hackers drain $320 million from Bitcoin's Liquid Network https://gizmodo.com/hackers-drain-320-million-from-bitcoins-liquid-network-keep-47-million-for-themselves-in-white-hat-operation-2000808262 - CoinDesk: Bitcoin network used by exchanges hit by $320 million exploit https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million -exploit-hackers-claim-they-re-the-good-guys --- VaultX: free crypto news and intelligence, https://vaultx.llc