# Liquid Network Halts After a Software Bug Produced 4,000 Bitcoin Out of Nothing

Blockstream paused the settlement layer used by exchanges and told them to stop deposits and withdrawals, and the people who took the $320 million are now negotiating a conditional return through on-chain messages.

- Published: 2026-09-07T05:14:53.350Z
- Canonical: https://polylog.news/2026-09-07/liquid-network-halts-after-a-software-bug-produced-4-000-bit
- Publisher: Polylog (Global desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys), [Bitcoin.com News](https://news.bitcoin.com/crypto-news/blockstream-hunts-white-hats-after-4000-btc-leaves-liquid/), [BeInCrypto](https://beincrypto.com/liquid-peg-320-million-whitehat-message/)

Liquid Network, a settlement layer that exchanges use to move bitcoin between one another, halted all transactions after about 4,000 bitcoin worth roughly $320 million left the system, [CoinDesk reported](https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys). Blockstream, which develops the network, traced the loss to a bug in the Elements protocol that allowed the creation of Liquid bitcoin that was never backed by a deposit. The tokens were then routed through the exchange service SideSwap.

The distinction matters technically. Security researchers cited by [Bitcoin.com News](https://news.bitcoin.com/crypto-news/blockstream-hunts-white-hats-after-4000-btc-leaves-liquid/) said the flaw sat in the node software that validates transactions, not in stolen keys or compromised hardware. Nobody broke into a vault. The accounting rule that is supposed to guarantee one token for one deposited coin failed inside the code itself.

Those responsible attached a message to one transaction reading "we are whitehats. contact us on chain," [BeInCrypto reported](https://beincrypto.com/liquid-peg-320-million-whitehat-message/), and the negotiation has continued in public through further on-chain messages. In an update relayed on 7 September, the people holding the funds asked whether returning "most" of the bitcoin to Blockstream's federation address would be acceptable once the vulnerability is fixed, and [CryptoSlate reported](https://cryptoslate.com/a-whitehat-hacker-is-holding-320-million-in-drained-bitcoin-until-developers-prove-they-patched-a-fatal-network-flaw/) that they say they have sent Blockstream encrypted technical details to help locate and close the flaw. Alex Thorn, head of research at the digital-asset firm Galaxy Digital, said the material appears intended to assist the fix. Blockstream has not confirmed a timeline for reopening the network or for any return of funds, and exchanges remain unable to deposit or withdraw Liquid bitcoin.

Bitcoin itself was unaffected at the base layer and traded near $79,900. That distinction still matters most for understanding the event. The scarcity that makes bitcoin attractive to buyers holds true on the main chain, but almost none of the industry's actual settlement happens there. It happens on sidechains, custodial ledgers and wrapped representations, each of which reintroduces exactly the discretionary issuance risk the base asset was designed to remove. A conditional offer to return the funds does not undo that: it shows the system's integrity now depends on the goodwill of whoever found the flaw first.

## What this means

The exposure sits with exchanges and market makers who held Liquid bitcoin as working capital and now cannot move it. When a settlement layer freezes, inventory that was assumed to be instantly transferable becomes illiquid, which widens spreads and reduces the depth market makers can offer across venues. The wider consequence is a reminder that convenience layers built on top of a fixed-supply asset can create supply the base chain never authorised, and the people holding the wrapped claim, not the chain, absorb that loss.

## What to watch

- Whether Blockstream restarts the network and on what terms, since a restart that honours all claims implies the shortfall was covered by someone.
- Whether the coins are returned, which would separate a genuine white-hat recovery from a theft using that label.
- Whether exchanges that relied on Liquid for inter-venue transfers announce alternatives, a sign of how much settlement capacity actually depended on it.