They appear to have kept roughly 598.5 BTC, worth about $47 million, as a bounty reward.
The Coinformer reached out to Blockstream and SideSwap for clarification on who is expected to cover the remaining shortfall and whether the 598.5 BTC retained by the attackers was agreed as a bounty.
A service used to move Bitcoin out of Liquid processed a 4,000-BTC-sized withdrawal "like any other order," nearly emptying the sidechain's Bitcoin reserves after attackers created BTCs through a software bug.
- Launched by Blockstream in 2018, Liquid is a Bitcoin sidechain pitched for faster, private BTC transfers and asset issuance that held about 4,200 BTC, worth roughly $320 million, before Sunday's incident.
- Blockstream also says more than $5 billion of tokenized real-world assets have been issued on the network.
- Bitcoin moved onto Liquid becomes Liquid Bitcoin (or just L-BTC) and normally, one BTC is locked on Bitcoin for every L-BTC created, per the project's documentation.
4,000 fake L-BTC looked real
But that mechanism broke on Sept. 6. SideSwap, a Liquid service authorized to process withdrawals, said in an X post that a customer sent it 4,000 L-BTC and the service "processed it like any other order," burned the tokens with valid authorization and 23 minutes later Liquid's federation released 3,996 BTC to the customer.
Statement on today's Liquid incident
— SideSwap (@side_swap) September 6, 2026
Today at 14:05 UTC a customer sent 4,000 L-BTC to the SideSwap peg-out service. Our service processed it like any other order: the L-BTC was burned on Liquid with a valid peg-out authorisation, and at 14:28 UTC the Liquid Federation paid…
The problem is that Blockstream later found out that the 4,000 L-BTC had been created through a bug in Elements, the software on which Liquid runs, according to SideSwap's post-mortem.
- The service said its own systems and authorization key weren't compromised and it had "no way to tell those coins from any other L-BTC."
- That single withdrawal represented roughly 95% of Liquid's Bitcoin reserves, according to Liquid's X post.
- The network was subsequently paused.
'No size limitations'
SideSwap's published peg-service documentation explicitly says there are "no size limitations" on transactions. A pre-incident version of its FAQ similarly said the service could support peg-ins and peg-outs and "there are no size limitations."
- But The Coinformer found that the FAQ live as of Sept. 7 no longer includes that transaction-limit section.
- It's unclear when the wording was removed.
- There's also no evidence the attackers bypassed a withdrawal cap.
The people holding the BTC instead describe themselves as "whitehats." In on-chain messages on Sept. 7, they told Blockstream to "fix the bug first" and said they would return "most" of the money after confirming every node had been patched.
Liquid whitehat hackers
Their identity and motives remain unverified.