The researcher found that the exploit transaction was never valid under Liquid's correct rules, but some vulnerable nodes mistakenly accepted it, causing the network to split temporarily.
Wiz didn't identify which specific Liquid nodes had accepted the invalid transaction.
After those nodes were patched, they returned to the valid chain, which Wiz said contains no fraudulent L-BTC.
Blockstream is threatening law enforcement against the self-described white hats who returned 85% of roughly $320 million taken from Liquid, even as a separate Bitcoin security team claims the company may have been warned about the underlying bug before the exploit.
Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is…— Blockstream (@Blockstream) September 11, 2026
Blockstream, the Bitcoin infrastructure company that developed Liquid and remains its technical provider, said in a Friday post on X that it "will not pay a ransom" for the roughly 598.5 BTC, worth about $47 million, still controlled by the people behind the Sept. 6 incident.
Blockstream
That is a considerably harder description than the one used immediately after the incident, when Liquid itself referred to the unknown actors as "purported white-hat hackers."
- The Coinformer was the first to note, shortly after the attackers returned most of BTC while retaining roughly 600 BTC, that no public agreement on a bug bounty had been announced.
- The Coinformer reached out to both Blockstream and SideSwap at the time to clarify whether any bounty had been authorized, but neither responded to requests for comment.
They already returned about $270 million
Liquid, a Bitcoin sidechain launched by Blockstream in 2018, lets users move BTC into a faster network where it is represented as L-BTC, a token normally backed one-for-one by real BTC held by the Liquid Federation.
- But on Sept. 6, unidentified actors exploited a vulnerability in Elements, the open-source software underlying Liquid, allowing them to create roughly 4,000 L-BTC without depositing the corresponding BTC.
- The tokens were then sent through SideSwap, a Liquid-based trading and settlement service, whose peg-out system processed them as valid and prompted the federation to release roughly 3,996 real BTC.
- The withdrawal represented about 95% of BTC then held in Liquid's federation wallet.
- The actors immediately identified themselves on-chain as "whitehats" and told Blockstream they would return most of the money once the vulnerability was fixed.
- Blockstream later sent a cryptographically signed message saying its bridge nodes had been patched and it was safe to return the funds.
- The actors then sent back 3,400 BTC (about 85% of what had been taken and worth roughly $270 million at the time).
- But they also kept about 598.5 BTC.
The dispute then escalated when the actors later told Blockstream to fund a 10% bug bounty with its own money or, according to their calculation, leave Liquid holders facing a roughly 15% shortfall.
Blockstream has now rejected the demand outright, describing the remaining BTC as stolen property and saying it will work with law enforcement, exchanges, forensic specialists and other service providers if it's not returned.
Another security team says Blockstream had warning
But a separate fight is now developing over whether the disaster could have been prevented.
Bitcoin Red Team, a volunteer group of developers using AI tools to audit Bitcoin-related open-source projects, has suggested it disclosed the relevant vulnerability to Blockstream before the exploit.
- The group, which earlier scanned 390 Bitcoin repositories and produced nearly 5,000 findings, including 85 rated critical, emerged this summer as part of a broader effort to find security flaws before attackers do.
- Calle, a Bitcoin developer and co-lead of the Red Team, responded to Blockstream CEO Adam Back's explanation of the bug by writing: "Turns out it only costs you 600 BTC to ignore an email from the red team."
turns out it only costs you 600 BTC to ignore an email from the red team 🟥 https://t.co/6N6si4ajLk
— dr. calle 🟥 (@callebtc) September 10, 2026
- Calle also accused Blockstream of giving an incomplete account of the earlier disclosure process and said the Red Team would publish its own full timeline after Blockstream restores operations and releases a postmortem.
But Samson Mow, the CEO of Bitcoin infrastructure company JAN3 and Blockstream's former chief strategy officer, has reportedly pushed back against suggestions that Blockstream ignored the team's emails.
Back, Blockstream's co-founder and CEO, has separately said on X that the exploitable condition emerged from an incorrect fix to another, previously non-critical bug that had itself been found using AI.
For now, the two sides appear to disagree over what Blockstream knew before nearly 4,000 BTC left Liquid and how clearly any earlier warning identified the eventual exploit path.
'Return the Bitcoin'
Liquid began producing blocks again on Sept. 10, while SideSwap reopened its markets and swaps.
Peg-ins and peg-outs, the mechanisms used to move BTC into and out of Liquid, remain disabled while the federation finishes its security review and works to restore full backing.
Blockstream says there will be no deal.