Liquid Network suffered a critical exploit on Sept. 6, 2026, that drained $320 million in Bitcoin. A group labeled "white hats" returned 3,400 BTC—approximately 85 percent of the haul—to Liquid's federation wallet. But 598.5 BTC, worth $47 million, remains in the group's hands with no public explanation.
The retention has sparked debate about whether this was a white-hat recovery or a negotiated ransom. "If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking," Guillemet wrote on X. No public bounty arrangement accounts for the outstanding funds.
Blockstream, the primary developer behind Liquid, deployed a patch to its bridge nodes on Sept. 7 to address the underlying code vulnerability. The network remains paused while the emergency update undergoes review before full redeployment. Operations will not resume until the fix is validated and deployed across the network.
