Attackers returned about 85% of the bitcoin withdrawn through a validation flaw, while the sidechain remains roughly 86% backed.
A validation logic bug in Blockstream's Liquid Network let attackers mint bitcoin that was never actually deposited, then withdraw roughly 4,000 BTC, worth approximately $319 million, between 13:53 and 14:28 UTC on . The exploit targeted a caching flaw in the Elements software's range proof verification, and the funds moved out through the SideSwap Peg out Authorization Key mechanism.
The following day, the attackers returned roughly 3,400 BTC, worth about $270 million and roughly 85% of the total, keeping approximately 600 BTC worth about $47 million. On chain messaging accompanying the return described the action as a "white-hat" disclosure. Blockstream has called that framing "purported" and has not confirmed it.
Reserve backing remains incomplete
What the 85% returned headline obscures is the network's current reserve position. Liquid's peg in and peg out services remain paused, and on-chain analysis puts the reserve backing ratio at roughly 86%, based on about 3,597 BTC in reserve against about 4,200 L-BTC still outstanding. That gap between full backing and 86% is a bigger, less discussed story than the raw hack size headline: even after a large, fast partial return, the wrapped bitcoin still circulating is not fully backed by reserves.
This was a validation failure in the software underpinning a Bitcoin sidechain, not a phishing attack or an exchange custody breach, which raises a more structural question than a typical crypto hack: whether the security assumptions behind Bitcoin-adjacent "DeFi" infrastructure, the kind exchanges and traders rely on for L-BTC liquidity, are sound.
Who carried out the attack has not been established, and Blockstream has not said whether it will confirm or dispute the "white-hat" framing. Exchanges that supported L-BTC have suspended its trading. Bitcoin itself traded roughly flat over the period, suggesting the market has so far treated the incident as contained to Liquid rather than a systemic Bitcoin event.