Liquid Network hackers keep $47 million after $320 million
Hackers negotiated publicly with the Liquid Network cryptocurrency platform, returning $266.5 million after the firm patched a vulnerability but keeping
Hackers withdrew $320 million from the Liquid Network cryptocurrency trading platform on Sunday. After a public, hours-long negotiation, they returned $266.5 million and kept $47 million as a reward for identifying a vulnerability, according to a report by Recorded Future News.
Blockstream, which runs Liquid Network, confirmed negotiations and said it deployed updated software. The company had paused all deposits and withdrawals after the incident. The hackers, who described themselves as "whitehats," initiated contact via a message attached to the blockchain transaction.
The Public Negotiation
The hackers' first message stated, "we are whitehats, contact us on chain." They later wrote, "Sending most back…is that ok," before demanding a fix. "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched." they added.
Blockstream and the hackers exchanged several public and private messages over roughly 12 hours. On Monday morning, the hackers sent back 4,000 BTC worth $266.5 million. They retained 598.5 BTC, valued at approximately $47 million.
Source of the Vulnerability
The incident ignited a fierce debate on social media and in blog posts about the vulnerability's origin. Blockstream and Liquid did not respond to requests for comment. SideSwap, the service used to move the stolen funds, published a post-mortem analysis.
That analysis said Blockstream believes the issue stemmed from a vulnerability in the Elements software. Several other blockchain security experts also traced the problem back to Elements. Founded in 2015, Elements allows for the creation of blockchains extending from Bitcoin's codebase.
The Liquid Network Platform
Backed by several major cryptocurrency players, Blockstream launched Liquid in 2018. The platform was designed to enable faster Bitcoin transactions. Blockstream claimed it would "improve a broken financial system" and "extend Bitcoin's use cases into the area of new capital markets."
Elements' website notes that "an example of an Elements based sidechain in production use is Blockstream’s Liquid." The platform supports a coin pegged to the price of Bitcoin.
The $320 million theft would rank among the largest cryptocurrency heists of 2026. Two incidents in April allegedly involved North Korean hackers stealing $290 million and $280 million from the Kelp and Drift platforms, respectively. The two sides continued exchanging public but encrypted messages on the blockchain after the funds were returned.
