# Liquid Sidechain Halted After 4,000 Bitcoin Pegged Out Through an Inflation Bug

Blockstream says no keys were stolen. The federation's signing hardware approved the withdrawal because the software judged the counterfeit tokens valid.

- Published: 2026-09-07T05:46:58.893Z
- Canonical: https://polylog.news/crypto/2026-09-07/liquid-sidechain-halted-after-4-000-bitcoin-pegged-out-throu
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys), [Bitcoin Magazine](https://bitcoinmagazine.com/news/alleged-white-hat-hackers-withdraw-4000-bitcoin-from-blockstreams-liquid-network-federation-reserves), [Polylog editors](https://polylog.news)

Blockstream paused the Liquid Network on Sept. 6 after roughly 4,000 bitcoin left the federation wallet that backs L-BTC, the pegged bitcoin token that circulates on the sidechain. [CoinDesk valued the withdrawal at about $320 million](https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys) and reported that the settlement layer, used by exchanges and traders to move bitcoin faster than the base chain allows, stopped processing transactions. Bridge nodes were disabled and exchanges were asked to suspend L-BTC deposits and withdrawals, [Bitcoin Magazine reported](https://bitcoinmagazine.com/news/alleged-white-hat-hackers-withdraw-4000-bitcoin-from-blockstreams-liquid-network-federation-reserves).

The attack path was not a stolen key. Preliminary accounts point to an inflation defect in Elements, the open-source software Liquid runs, which allowed the creation of more than 4,000 L-BTC that no bitcoin backed. Those tokens were then redeemed through an ordinary peg-out. Because the redemption satisfied the consensus rules as the software implemented them, the hardware security modules held by federation members signed the bitcoin transaction. Blockstream's public proof-of-reserves page showed federation holdings falling from more than 4,200 bitcoin to just over 200.

The people holding the coins have communicated in public. They moved funds and attached messages in the arbitrary-data field of bitcoin transactions, first stating that they are ethical hackers and asking to be contacted on-chain, then supplying a Signal handle. A reply transaction, presumed to come from Blockstream, carried a contact address. [Watcher Guru reported](https://t.me/WatcherGuru/14946) that the group intends to return the bitcoin once the vulnerability is fixed, and [Cointelegraph reported](https://t.me/cointelegraph/71982) that Liquid described the withdrawal as the work of people claiming to be ethical hackers. No return has been confirmed.

Two interpretations of these facts are possible, and neither can yet be ruled out. If the group is genuine, the on-chain messages are the cheapest way to open negotiation and secure a fee. If it is not, the same messages delay a reckoning while the market decides what unbacked L-BTC is worth. What this incident makes clear is the trust model underneath it: L-BTC holders were never exposed to Bitcoin's consensus, they were exposed to a federation's software and its signing policy, and one defect in that software converted a claim on 4,200 bitcoin into a claim on roughly 200.

## What this means

Every wrapped or pegged bitcoin token is a credit claim on the operator of the peg, and this incident shows the claim can fail without any key being compromised. The exposed parties are L-BTC holders, the exchanges and trading desks that used Liquid for fast settlement, and Blockstream, which must decide whether to fully compensate holders from its own balance sheet if the coins are not returned. The broader channel runs through every federated or multi-signature bridge: audits scoped to signing security do not catch a mint defect that makes a fraudulent withdrawal look legitimate to the signers.

## What to watch

- Whether the bitcoin is returned and on what terms, since a negotiated return sets an informal market rate for what a $320 million bug is worth and shapes how the next group behaves.
- How Blockstream reconciles the peg, specifically whether outstanding L-BTC is honored one-for-one from company funds or holders absorb the shortfall, which determines whether pegged tokens are treated as corporate liabilities.
- Whether other Elements-derived chains publish patches, because the same code base runs beyond Liquid and a shared defect would widen the exposure.