The Liquid Network hack exploited a bug in SideSwap, resulting in 3,998 BTC (~$313 million) being transferred to the attackers. The hackers claimed white-hot intentions, returning 3,400 BTC after the fixes, leaving 598 BTC missing. The network remains suspended as Blockstream and Federation patch vulnerabilities and prepare for a safe restart. The latest twist in the Bitcoin Liquid Network hack is worthy of a short film, if not a full-length feature film. Apparently, the hackers are actually the good guys who stole the money to “keep it safe” until the vulnerability in the protocol is completely fixed. They promised to return the money later. What is a liquid network? Liquid Network was designed to solve a specific problem in the Bitcoin blockchain that was quite slow. Transactions on the network are recorded in a “block”, which is added to the chain approximately every 10 minutes. Additionally, each block can only contain a limited number of transactions, meaning the network can process fewer transactions per second compared to conventional payment systems. Transactions that do not fall into a particular block must wait for the next one, which increases confirmation time. Latest videos fromTechRadar To solve this problem, Liquid Network was created. It has its own Bitcoin reserve and its own blockchain, also known as a sidechain. When a person wants to use the Liquid Network to quickly send money, they first convert their Bitcoin to Liquid Bitcoin, or L-BTC. They can then send it to another person much faster than a normal Bitcoin transaction. The recipient can store the money in Liquid or convert it back to regular Bitcoin and move it to the Bitcoin network. In this way, Liquid provides a faster network without requiring every transaction to take place directly on the Bitcoin blockchain. In addition to accelerating Bitcoin transactions, Liquid Network also allows users (companies and other organizations) to create and trade other digital assets, including tokenized securities or stablecoins. The project was created by Blockstream, a Bitcoin-focused technology company founded in 2014. It is operated by the Liquid Federation, a group of over 80 member companies including exchanges, infrastructure companies and financial institutions. A smaller group of members (15 to be exact) manage the network’s “functionaries” (the servers that keep the network running), while the broader group has a management role. Members vote on three boards (Technology, Membership, and Oversight), discussing ideas such as technical leadership, house rules, membership, and more. Sign up for the TechRadar Pro newsletter to get all the top news, views, features and advice your business needs to succeed! What happened to him? In early September 2026, unknown participants managed to generate approximately 4,000 L-BTC without investing the corresponding 4,000 BTC in Liquid. Once they did this, they sent L-BTC through SideSwap, a legitimate service that is used to convert L-BTC back to Bitcoin and vice versa. The system apparently considered the withdrawal to be legitimate, as it was later revealed that the bug prevented SideSwap from distinguishing between “real” and “fake” L-BTC and treating them equally. As a result, Liquid Federation transferred 3,998 real BTC to the attackers (more than $313 million at the time of publication). Once operators realized what had happened, they suspended new transactions and warned of possible disruptions until service was restored. Then the movie took a twist: the hacker began communicating with network maintainers through on-chain Bitcoin transactions, promising to return the funds once the vulnerability was completely patched: “Please fix the bug first. The chain is at risk on the last commit right now. Make sure every node is fixed. We will then transfer the money back securely once the fix is confirmed,” one message read. Earlier today, Coindesk reported that the hackers partially kept their promise by returning 3,400 of the 4,000 leaked BTC, indicating that the vulnerability had been patched. The remaining 598 BTC, worth approximately $47 million, are currently unaccounted for. “3,400 BTC of the approximately 4,000 BTC withdrawn on September 6th have been returned to the Liquid Federation wallet. The return follows confirmation from Blockstream that the affected bridge nodes have been patched,” Samson Moe, Blockstream’s former chief strategy officer, wrote on X. “Approximately 598 BTC remains outstanding and Blockstream continues to collaborate with white hat hackers.” He added that the network remains suspended while Blockstream and Federation members make additional fixes and security improvements, resolve chain splits, and prepare for a safe restart. “During this time, Liquid wallets and services will continue to be impacted. No user action is required, and please do not send Bitcoin to Liquid anchor addresses until we confirm a network restart,” he added. The best antivirus for any budget Follow TechRadar on Google News. And add us as your preferred source to get our expert news, reviews and opinions in your feeds. Post navigation The rise of hairy young women: “I know people who dye their armpit hair to make it stand out more” Bombardier points to US presence after Trump says aerospace giant should build in America