Blockstream’s Liquid peg has 207 bitcoin left.
Two explorers, two answers, and only one of them is reading a live node.
We did not take this one from a tweet. We read Blockstream’s own explorer.
At 3:32 PM ET their Liquid API reports 18,356.8785 bitcoin pegged in over the chain’s life and 18,149.6035 pegged out. The difference is what the federation is supposed to be holding: 207.2750 bitcoin. Net of burns, 197.2472 L-BTC are circulating. This morning the peg carried about 4,205. Roughly 3,997.74 bitcoin left, about $319 million at $79,819.
The on-chain message that came with it says: “we are whitehats. contact us on chain.” Around 3,998 of those coins had not been mixed as of mid-afternoon.
Liquid is an 11-of-15 federated multisig. The peg-out path is not supposed to let anyone pull coins out of the sidechain on their own say-so, which is the part that has no public explanation yet. As of 3:17 PM ET neither Blockstream, Liquid nor Adam Back had said anything.
Here is the part nobody else is reporting, and it cuts the other way from the panic. The chain never stopped. Blockstream’s explorer put the Liquid tip at block 4,050,675 one minute before we looked. Blocks are still landing every sixty seconds. Whatever happened to the peg, the federation has not halted the network, and that is a decision somebody made.
And a correction of our own earlier read, because the details matter. mempool.space’s Liquid index is stalled — its Liquid tip has sat at block 4,050,335 since 13:52 UTC — so its L-BTC supply figure is frozen at 4,205.02. But its federation audit reads the Bitcoin chain directly, and that side is current and correct: 197.47 BTC in the federation wallet. Their holdings figure is keyed to Bitcoin blocks, not Liquid’s. SideSwap’s own statement puts the payout at 14:28 UTC, 10:28 AM ET, so the audit carried the shortfall from the moment that transaction confirmed — close to five hours before the first story ran at 3:17 PM ET. That is a derivation from how the page labels its own number, not something we watched happen. We wrote earlier that a reader checking mempool would see a full peg and conclude nothing happened. That was wrong. Half their page is frozen; the half that counts the coins was ahead of everyone.
That is the whole lesson of a federated sidechain in one afternoon. The coins sit behind fifteen keys you do not hold, the explorer you check is a website, and the confirmation that anything is wrong comes from the company whose keys they are. On the base chain you would already know, because you would have checked your own node.
Not your keys is not a slogan about exchanges. It is a sentence about every layer that holds coins on your behalf.
UPDATE, TUE SEP 8, 3:48 PM ET. Liquid’s official incident report is out, and it says the network will undo the theft.
Liquid Network posted a full incident report on its verified account at about 7:10 PM UTC. It is a company statement, and we are printing it as one. Nothing in it is confirmed by our own reading of the chain.
Start with what does not add up. The report says the roughly 4,000 unbacked L-BTC were created on September 6 at 15:53:10 UTC, in Liquid block 4,050,336. But SideSwap, another Federation member, has already said a customer sent it 4,000 L-BTC at 14:05 UTC and that the Federation paid out 3,996 bitcoin at 14:28 UTC. That is the coins being spent about eighty-five minutes before the report says they were made. Two members of the same Federation, two statements, and an order of events that cannot both be true. We are not calling it a lie. We are saying the two timelines do not reconcile, and we have asked.
Now the part worth the update. The report names the bug: a flaw in the open-source Elements software in how Liquid nodes cache range-proof verifications. Sunday’s guesses — Confidential Transactions at the node level — were in the right area; this is the specific mechanism, and it confirms the read that the bug made coins out of nothing.
And here is the sentence nobody is quoting. The functionaries are going to undo it. In their own words, they will “restore the corrected network state, including rejection of the invalid peg-out.” A federated chain is going to rewrite its own recent history because the operators agreed to. Read that twice. It is the whole argument about who really controls a sidechain, stated by the people who control this one. Be exact about what it means: the bitcoin that left the peg wallet is on the Bitcoin chain and is not moving. It is the Liquid ledger’s version of events that gets corrected. Nobody is reversing a Bitcoin transaction.
The fix has a version and a clock now: an emergency Elements release, v23.3.4, in “approximately 48 hours.” This page has spent two days noting Elements had shipped nothing since 23.3.3 on April 13. Now there is a number and a deadline.
Two more from the report. It says the bridge nodes were patched on September 7 at 01:09 UTC — about eight and a half hours before Blockstream told the holders “bridge nodes are patched, safe to return the funds” at 09:41 UTC, per Galaxy’s table. Probably verification, not delay, but it is dated now. And Blockstream’s official language now calls the party holding the coins “the white hat hacker.”
The report also confirms what this page reported first: the reserve fell from 4,205 to 197; no keys were compromised; the peg-out mechanism worked exactly as designed; other Liquid assets are unaffected but frozen; 3,400 bitcoin came back on September 7 at 16:09:25 UTC. It calls the outstanding piece 15%. That is their number on their basis; the holding address still shows 598.49987177 bitcoin, last moved September 8 at 02:41 UTC, by our reading of the Bitcoin chain. One last detail: the fall from 4,205 to 197 was not all theft — the report says a few ordinary peg-outs, about 8 bitcoin, went out in the same window before operations halted.
UPDATE, TUE SEP 8, 9:02 AM ET. Blockstream said the restart was being prepared. That was fourteen and a half hours ago.
Read from Blockstream’s own Liquid explorer at 8:38 AM ET, the network is still stopped. The Liquid tip sits at block 4,051,232, and the explorer’s own counter reads 1,908 minutes past the expected interval — 31.8 hours on a chain that makes a block a minute. 287 transactions are queued, the next block already 99.74% full and still filling. The last block landed shortly before 1:00 AM ET Monday, roughly forty minutes after this story’s 12:08 AM Monday update went up. Blockstream’s restart statement was 6:00 PM ET Monday. Fourteen and a half hours later there are no blocks.
And the company’s own reserve page now flatters itself. Blockstream’s Proof of Reserves panel, on the same explorer, reads “Federation BTC Holdings 207.32500781 BTC,” last changed 2026-09-06 16:27:10, “Assets vs Liabilities 105.083%.” That holdings figure is from before the 3,400 came back; the panel has not moved since Sunday afternoon and it tells a reader the peg is over-collateralised. mempool.space says the opposite — 4,205.02 L-BTC against 3,597.47199026 BTC in the federation wallet, 85.55%, our arithmetic. Neither is true, and both pages are half stale. On Sunday mempool’s Liquid index was frozen and Blockstream’s was live; today it is reversed, and it is the company’s page reading rich. The only figure anyone can verify is the federation’s Bitcoin-side balance, 3,597.47 BTC, because that reads the Bitcoin chain. The L-BTC liability is unknowable while the chain is halted, and per Mononaut it is unknowable at all if the bug minted L-BTC.
The two sides are still talking, and Galaxy Research laid the exchange out in full this morning. Three things in it this page did not have. The dialog is live: at block 966,023, 06:02 UTC, Blockstream sent a 2,248-character ciphertext, 3,168 bytes on chain, about ten times the size of any other message in the exchange; at block 966,052, 09:41 UTC, the holders answered, 2,019 bytes. The “:(” was not the end — three messages have passed since it. And 193 small payments from 143 different senders have hit the holding address since the first message, 0.00264 BTC in all, 184 of them carrying OP_RETURN text: a Signal handle, a lawyer’s offer, wallet adverts, swap-service and memecoin spam. The holders have swept 191 of them into their own replies. That is the balance creep this page flagged Monday at 6:05 PM and correctly refused to explain — they are eating the spam as inputs. One detail worth keeping: Blockstream sends most of its messages from a fresh address each time, so identity here is the PGP signature, not the address. Galaxy published the table; we are not rebuilding it.
The 598 is still out. 598.49987177 BTC as of 02:41 UTC, up 11,127 satoshis from the 598.49976050 this page read Monday at 6:05 PM — message traffic, not a return.
UPDATE, MON SEP 7, 9:57 PM ET. Blockstream says the restart is being prepared.
At 6:00 PM ET Blockstream posted that updated software has been deployed and the federation is preparing the network for a coordinated restart, with more hardening to come. It is the company’s word that Liquid is coming back — not a time, and not a resolution.
Because one thing a restart does not settle: the exploit was an inflation bug, and on a confidential chain the total L-BTC in existence cannot be audited by looking. Bringing the network back does not prove how much L-BTC is real. That question, the one Mononaut named Sunday, stays open when peg-outs reopen.
UPDATE, MON SEP 7, 6:05 PM ET. The network is still down, and there is one thing not to do.
At 4:33 PM ET, Blockstream and Samson Mow posted on the state of the network itself, which is the part this page had not covered. Everything above is money we watched move on the Bitcoin chain. This is not that. It is a company statement and we are printing it as one.
Do not send bitcoin to a Liquid peg-in address. Blockstream says so directly, and says it holds until they confirm the network has restarted.
The reason is new. The federation is resolving a chain split before it restarts — the network’s own nodes disagreed about its history, and that has to be settled before anything moves again. Until then the network stays paused and Liquid wallets and services stay affected. A peg-in right now goes into a chain that has not agreed with itself yet.
The 598 has not moved. At 6:05 PM ET, mempool.space showed the address holding it at 598.49976050 bitcoin across twelve confirmed outputs — about twenty thousand satoshis more than the 598.49955894 it kept as change at 12:09 PM, not less. That difference is message traffic, not a return. One more payment was arriving unconfirmed while we looked, 320 satoshis. We cannot tell you who sent it. Mow published this address, and a public address collects dust from onlookers as readily as from a counterparty.
UPDATE, MON SEP 7, 2:51 PM ET. Both sides are talking, and the chain proves it.
At 1:54 PM ET, in block 965,956, Blockstream answered — from a wallet it had not used before, bc1q57fqwl04n6fsnyd579zs7nlzywzsr5ftv5es49. The message is signed and the body is encrypted to the sender’s key. Forty-one minutes later, in block 965,962, the sender wrote back and paid the federation wallet a thousand satoshis to do it.
Here is the part worth understanding, because it is not a guess. That second transaction spends an output of the first. Until now every message in this exchange was a separate payment that happened to arrive in order, and calling one a reply to another was inference. This one consumes the coin Blockstream sent. On a public ledger that is a reply in the only sense that cannot be faked.
We also confirmed the message we could not stand up this morning. At 7:46 AM ET, block 965,922, Blockstream sent the sender a signed line in plain text: bridge nodes are patched, safe to return the funds. That is the condition being answered, and the 3,400 bitcoin moved four hours and twenty-three minutes later.
Samson Mow published the full timeline first and it holds up on every point we checked, including the one above. Credit where it is owed.
What none of it tells you is what they are saying. Every message since 8:43 AM this morning has been ciphertext with no plaintext attached, in both directions. We can prove who is talking to whom, in what order, and that each is reading the other. We cannot read a word of it, and neither can anyone else telling you what the remaining 598 bitcoin is worth to either side.
UPDATE, MON SEP 7, 1:19 PM ET. 3,400 bitcoin went back.
At 12:09 PM ET, in Bitcoin block 965,950, the address holding the coins sent 3,400.00000000 bitcoin to the Liquid federation’s wallet. Every input on that transaction is theirs. Two outputs, no ambiguity: 3,400 across, 598.49955894 kept as change, a fee of 1,768 satoshis.
The federation’s wallet went from 197.47 bitcoin this morning to 3,597.47193204 at block 965,950. The sender kept 598.49955894 as change on that transaction. We read both on two independent explorers and they agree to the satoshi. That is roughly 85% of what walked out on Sunday.
We cannot tell you why 3,400, and neither can anyone else. At 8:43 AM ET, block 965,930, the sender wrote “plz confirm again that we are sending the coins back to bc1qdlld6…” and attached a PGP block headed “More details about the vuln fix”. At 11:31 AM, block 965,948, they sent the federation a message encrypted end to end with no plaintext at all. Thirty-eight minutes after that, the money moved. Whatever was agreed is inside that encryption. Bounty, first tranche, percentage — anyone naming it is guessing.
One thing the arithmetic does say. The round number is on the way out, not on what stayed behind. They sent exactly 3,400.00000000 and kept an ugly 598.49955894. A negotiated percentage leaves a clean remainder. This leaves a clean payment. What was agreed was the figure to return.
And a warning, because this is where people lose coins. Three messages arrived at the federation’s wallet this morning claiming white-hat control and pointing readers at a different address. None of them came from the wallet holding the money. Eight more sit unconfirmed from eight separate senders, including one that accuses named Blockstream staff of running the hack and another selling a memecoin. The messages that matter are signed by the address holding 3,400 bitcoin an hour ago. Everything else attached to that wallet is somebody talking.
UPDATE, MON SEP 7, 10:29 AM ET. The condition was answered overnight.
At 7:46 AM ET, block 965,922, Blockstream sent a PGP-signed message to the address holding the coins: “Bridge nodes are patched, safe to return the funds.” At 8:43 AM, block 965,930, the reply asked for one more confirmation of where to send them, attaching a PGP block headed “More details about the vuln fix.” As of block 965,942 nobody has answered that question, and the 3,998.4996 bitcoin have not moved.
Which leaves the thing this story has been checking since midnight. The public code has not moved either. Elements still has no release since 23.3.3 on April 13. The newest commits are still a build-script fix from September 4 and an RPC fix from September 1. The security advisory list is still empty.
The condition, in the words of the people holding the money, was to make sure every node is patched. The answer covers bridge nodes, which are the federation’s own machines. From what we can tell those are not the same thing, and Liquid is a federation of more than eighty members on top of anyone else running the software.
Patching your own infrastructure first and publishing after is how responsible disclosure is supposed to work. We are not suggesting otherwise. We are saying that right now the fix exists on Blockstream’s machines and in no place a node operator can go and get it, and that the difference is checkable by anyone in a minute.
One point from the overnight read still stands: mempool developer Mononaut named the risk if the bug minted L-BTC from nothing — “if it’s an inflation bug, the L-BTC is no longer in limited supply.”
UPDATE, MON SEP 7, 12:08 AM ET. The people holding the coins say the bug is still live.
Blockstream told CoinDesk it found that a software bug in Elements had created some of the bitcoin involved. That answers the question this story left open at 5:52 PM: where the 4,000 L-BTC came from. Not a stolen key. Coins that were never supposed to exist, walked out through a working front door.
Then the chain said more than the statements did. Three messages sit in the Liquid federation’s own bitcoin wallet, every one of them sent from bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte — the address holding 3,998.4985 bitcoin right now. Whoever signed them controls the money. That is not a claim, it is a signature.
At 2:30 PM ET, block 965,818: “we are whitehats. contact us on chain.” At 10:20 PM, block 965,869: “sending most back to bc1qdlld6…, is that ok.” At 11:30 PM, block 965,875, carrying 1,512 bytes encrypted to Blockstream’s published PGP key: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
They offered to give it back, then made giving it back conditional on the patch.
Blockstream was answering the whole time, and this story said otherwise. Three messages come back from bc1qn8mgsmxx42j3fflqfkh0cqhdd6mj4h9q2mfqym. At 3:31 PM ET, block 965,822: “Please contact security@blockstream.com.” At 9:49 PM, block 965,865, a message encrypted to the attacker’s own key. At 11:30 PM, block 965,875, PGP-signed, two words: “Yes, thank you.”
We wrote at 12:08 AM that we could not find a reply. We searched the federation’s wallet. Blockstream was writing to the attacker’s address, which is where anyone would write back. Our mistake, corrected at the foot of this page.
Samson Mow published the sequence with links and caught the part that matters most, which we had missed. Blockstream’s “Yes, thank you” landed in the same block as “fix the bug first,” but it answers the offer from an hour earlier, not the condition. Nobody has answered the condition.
Here is the part anyone can check and nobody is checking. As of 12:08 AM ET the Elements repository has shipped nothing. Last release 23.3.3, April 13. The last three commits are a build fix for a Qt download link on September 4 and an RPC error fix on September 1. The security advisory list is empty.
A code repository and an attacker’s signed message are not friendly witnesses. Tonight they say the same thing.
UPDATE, 5:52 PM ET. The federation paused it.
Liquid Network’s statement confirms roughly 4,000 bitcoin and adds the part that matters: the coins left through the SideSwap Peg-out Authorization Key, and “that key was not compromised, nor were any others.” Bridge nodes are disabled. No new transactions can be submitted. “Effectively the Liquid sidechain is paused until this issue is resolved.” Other Liquid assets, USDT and DePix and the RWAs, are unaffected. Exchanges have paused L-BTC deposits and withdrawals.
Our 3:32 PM finding stands as written. The chain was live then, tip one minute old, and we said the federation had not halted it and that was a decision somebody made. Ninety minutes later they made the other decision.
SideSwap filled in the middle. At 14:05 UTC a customer sent them 4,000 L-BTC. They processed it like any other order, burned the L-BTC with a valid peg-out authorisation, and at 14:28 UTC the Federation paid out 3,996 bitcoin.
Read the three statements together. Nothing was stolen in the way people mean by the word. Every signature was good. The customer was a customer, the key was valid, and eleven of fifteen keys did what they are supposed to do. The whole question is where those 4,000 L-BTC came from before they were handed over.
Samson Mow says the working theory is Liquid’s Confidential Transactions, a node-level issue, not the PAKs and not the HSMs, and that developers cannot confirm it yet.
Confidential Transactions hide amounts. That is the feature. It is also why nobody saw this by watching the chain. Where amounts are hidden, supply cannot be audited by looking. The only honest number is the bitcoin sitting on the public side of the peg, which is the one we read at 3:32, and it says 207.
Liquid’s statement tells people to monitor the situation at mempool’s liquid.network. Read it the way our own correction says to read it. The Liquid index is still frozen at block 4,050,335 from 13:52 UTC, eight hours stale as of 6:08 PM ET, so the 4,205.02 L-BTC in circulation is the pre-drain number. The federation holdings figure reads the Bitcoin chain live and says 197.47 BTC, as of Bitcoin block 965,836. Two numbers, two clocks, one page.
UPDATE, 4:15 PM ET. mempool.space’s Liquid federation audit puts the arithmetic on one screen. 4,205.02 L-BTC are in circulation by its last Liquid read (block 4,050,335, where its index is stalled), and the federation’s wallet on the Bitcoin chain — which the audit reads live — holds 197.47 BTC against them, as of Bitcoin block 965,827. For every 1 L-BTC out there, the wallet behind it holds about 0.047 bitcoin. That is 4.696% backing, our arithmetic from their two figures. The audit also shows the two documented paths for coins to leave the federation untouched: Emergency Keys, zero usages; timelock-expired UTXOs, zero.
At the time of this writing, bitcoin was $78,366 (Crypto.com, 3:48 PM ET, Sep 8).
At 3:32 PM ET their Liquid API reports 18,356.8785 bitcoin pegged in over the chain’s life and 18,149.6035 pegged out. The difference is what the federation is supposed to be holding: 207.2750 bitcoin. Net of burns, 197.2472 L-BTC are circulating. This morning the peg carried about 4,205. Roughly 3,997.74 bitcoin left, about $319 million at $79,819.
The on-chain message that came with it says: “we are whitehats. contact us on chain.” Around 3,998 of those coins had not been mixed as of mid-afternoon.
Liquid is an 11-of-15 federated multisig. The peg-out path is not supposed to let anyone pull coins out of the sidechain on their own say-so, which is the part that has no public explanation yet. As of 3:17 PM ET neither Blockstream, Liquid nor Adam Back had said anything.
Here is the part nobody else is reporting, and it cuts the other way from the panic. The chain never stopped. Blockstream’s explorer put the Liquid tip at block 4,050,675 one minute before we looked. Blocks are still landing every sixty seconds. Whatever happened to the peg, the federation has not halted the network, and that is a decision somebody made.
And a correction of our own earlier read, because the details matter. mempool.space’s Liquid index is stalled — its Liquid tip has sat at block 4,050,335 since 13:52 UTC — so its L-BTC supply figure is frozen at 4,205.02. But its federation audit reads the Bitcoin chain directly, and that side is current and correct: 197.47 BTC in the federation wallet. Their holdings figure is keyed to Bitcoin blocks, not Liquid’s. SideSwap’s own statement puts the payout at 14:28 UTC, 10:28 AM ET, so the audit carried the shortfall from the moment that transaction confirmed — close to five hours before the first story ran at 3:17 PM ET. That is a derivation from how the page labels its own number, not something we watched happen. We wrote earlier that a reader checking mempool would see a full peg and conclude nothing happened. That was wrong. Half their page is frozen; the half that counts the coins was ahead of everyone.
That is the whole lesson of a federated sidechain in one afternoon. The coins sit behind fifteen keys you do not hold, the explorer you check is a website, and the confirmation that anything is wrong comes from the company whose keys they are. On the base chain you would already know, because you would have checked your own node.
Not your keys is not a slogan about exchanges. It is a sentence about every layer that holds coins on your behalf.
UPDATE, TUE SEP 8, 3:48 PM ET. Liquid’s official incident report is out, and it says the network will undo the theft.
Liquid Network posted a full incident report on its verified account at about 7:10 PM UTC. It is a company statement, and we are printing it as one. Nothing in it is confirmed by our own reading of the chain.
Start with what does not add up. The report says the roughly 4,000 unbacked L-BTC were created on September 6 at 15:53:10 UTC, in Liquid block 4,050,336. But SideSwap, another Federation member, has already said a customer sent it 4,000 L-BTC at 14:05 UTC and that the Federation paid out 3,996 bitcoin at 14:28 UTC. That is the coins being spent about eighty-five minutes before the report says they were made. Two members of the same Federation, two statements, and an order of events that cannot both be true. We are not calling it a lie. We are saying the two timelines do not reconcile, and we have asked.
Now the part worth the update. The report names the bug: a flaw in the open-source Elements software in how Liquid nodes cache range-proof verifications. Sunday’s guesses — Confidential Transactions at the node level — were in the right area; this is the specific mechanism, and it confirms the read that the bug made coins out of nothing.
And here is the sentence nobody is quoting. The functionaries are going to undo it. In their own words, they will “restore the corrected network state, including rejection of the invalid peg-out.” A federated chain is going to rewrite its own recent history because the operators agreed to. Read that twice. It is the whole argument about who really controls a sidechain, stated by the people who control this one. Be exact about what it means: the bitcoin that left the peg wallet is on the Bitcoin chain and is not moving. It is the Liquid ledger’s version of events that gets corrected. Nobody is reversing a Bitcoin transaction.
The fix has a version and a clock now: an emergency Elements release, v23.3.4, in “approximately 48 hours.” This page has spent two days noting Elements had shipped nothing since 23.3.3 on April 13. Now there is a number and a deadline.
Two more from the report. It says the bridge nodes were patched on September 7 at 01:09 UTC — about eight and a half hours before Blockstream told the holders “bridge nodes are patched, safe to return the funds” at 09:41 UTC, per Galaxy’s table. Probably verification, not delay, but it is dated now. And Blockstream’s official language now calls the party holding the coins “the white hat hacker.”
The report also confirms what this page reported first: the reserve fell from 4,205 to 197; no keys were compromised; the peg-out mechanism worked exactly as designed; other Liquid assets are unaffected but frozen; 3,400 bitcoin came back on September 7 at 16:09:25 UTC. It calls the outstanding piece 15%. That is their number on their basis; the holding address still shows 598.49987177 bitcoin, last moved September 8 at 02:41 UTC, by our reading of the Bitcoin chain. One last detail: the fall from 4,205 to 197 was not all theft — the report says a few ordinary peg-outs, about 8 bitcoin, went out in the same window before operations halted.
UPDATE, TUE SEP 8, 9:02 AM ET. Blockstream said the restart was being prepared. That was fourteen and a half hours ago.
Read from Blockstream’s own Liquid explorer at 8:38 AM ET, the network is still stopped. The Liquid tip sits at block 4,051,232, and the explorer’s own counter reads 1,908 minutes past the expected interval — 31.8 hours on a chain that makes a block a minute. 287 transactions are queued, the next block already 99.74% full and still filling. The last block landed shortly before 1:00 AM ET Monday, roughly forty minutes after this story’s 12:08 AM Monday update went up. Blockstream’s restart statement was 6:00 PM ET Monday. Fourteen and a half hours later there are no blocks.
And the company’s own reserve page now flatters itself. Blockstream’s Proof of Reserves panel, on the same explorer, reads “Federation BTC Holdings 207.32500781 BTC,” last changed 2026-09-06 16:27:10, “Assets vs Liabilities 105.083%.” That holdings figure is from before the 3,400 came back; the panel has not moved since Sunday afternoon and it tells a reader the peg is over-collateralised. mempool.space says the opposite — 4,205.02 L-BTC against 3,597.47199026 BTC in the federation wallet, 85.55%, our arithmetic. Neither is true, and both pages are half stale. On Sunday mempool’s Liquid index was frozen and Blockstream’s was live; today it is reversed, and it is the company’s page reading rich. The only figure anyone can verify is the federation’s Bitcoin-side balance, 3,597.47 BTC, because that reads the Bitcoin chain. The L-BTC liability is unknowable while the chain is halted, and per Mononaut it is unknowable at all if the bug minted L-BTC.
The two sides are still talking, and Galaxy Research laid the exchange out in full this morning. Three things in it this page did not have. The dialog is live: at block 966,023, 06:02 UTC, Blockstream sent a 2,248-character ciphertext, 3,168 bytes on chain, about ten times the size of any other message in the exchange; at block 966,052, 09:41 UTC, the holders answered, 2,019 bytes. The “:(” was not the end — three messages have passed since it. And 193 small payments from 143 different senders have hit the holding address since the first message, 0.00264 BTC in all, 184 of them carrying OP_RETURN text: a Signal handle, a lawyer’s offer, wallet adverts, swap-service and memecoin spam. The holders have swept 191 of them into their own replies. That is the balance creep this page flagged Monday at 6:05 PM and correctly refused to explain — they are eating the spam as inputs. One detail worth keeping: Blockstream sends most of its messages from a fresh address each time, so identity here is the PGP signature, not the address. Galaxy published the table; we are not rebuilding it.
The 598 is still out. 598.49987177 BTC as of 02:41 UTC, up 11,127 satoshis from the 598.49976050 this page read Monday at 6:05 PM — message traffic, not a return.
UPDATE, MON SEP 7, 9:57 PM ET. Blockstream says the restart is being prepared.
At 6:00 PM ET Blockstream posted that updated software has been deployed and the federation is preparing the network for a coordinated restart, with more hardening to come. It is the company’s word that Liquid is coming back — not a time, and not a resolution.
Because one thing a restart does not settle: the exploit was an inflation bug, and on a confidential chain the total L-BTC in existence cannot be audited by looking. Bringing the network back does not prove how much L-BTC is real. That question, the one Mononaut named Sunday, stays open when peg-outs reopen.
UPDATE, MON SEP 7, 6:05 PM ET. The network is still down, and there is one thing not to do.
At 4:33 PM ET, Blockstream and Samson Mow posted on the state of the network itself, which is the part this page had not covered. Everything above is money we watched move on the Bitcoin chain. This is not that. It is a company statement and we are printing it as one.
Do not send bitcoin to a Liquid peg-in address. Blockstream says so directly, and says it holds until they confirm the network has restarted.
The reason is new. The federation is resolving a chain split before it restarts — the network’s own nodes disagreed about its history, and that has to be settled before anything moves again. Until then the network stays paused and Liquid wallets and services stay affected. A peg-in right now goes into a chain that has not agreed with itself yet.
The 598 has not moved. At 6:05 PM ET, mempool.space showed the address holding it at 598.49976050 bitcoin across twelve confirmed outputs — about twenty thousand satoshis more than the 598.49955894 it kept as change at 12:09 PM, not less. That difference is message traffic, not a return. One more payment was arriving unconfirmed while we looked, 320 satoshis. We cannot tell you who sent it. Mow published this address, and a public address collects dust from onlookers as readily as from a counterparty.
UPDATE, MON SEP 7, 2:51 PM ET. Both sides are talking, and the chain proves it.
At 1:54 PM ET, in block 965,956, Blockstream answered — from a wallet it had not used before, bc1q57fqwl04n6fsnyd579zs7nlzywzsr5ftv5es49. The message is signed and the body is encrypted to the sender’s key. Forty-one minutes later, in block 965,962, the sender wrote back and paid the federation wallet a thousand satoshis to do it.
Here is the part worth understanding, because it is not a guess. That second transaction spends an output of the first. Until now every message in this exchange was a separate payment that happened to arrive in order, and calling one a reply to another was inference. This one consumes the coin Blockstream sent. On a public ledger that is a reply in the only sense that cannot be faked.
We also confirmed the message we could not stand up this morning. At 7:46 AM ET, block 965,922, Blockstream sent the sender a signed line in plain text: bridge nodes are patched, safe to return the funds. That is the condition being answered, and the 3,400 bitcoin moved four hours and twenty-three minutes later.
Samson Mow published the full timeline first and it holds up on every point we checked, including the one above. Credit where it is owed.
What none of it tells you is what they are saying. Every message since 8:43 AM this morning has been ciphertext with no plaintext attached, in both directions. We can prove who is talking to whom, in what order, and that each is reading the other. We cannot read a word of it, and neither can anyone else telling you what the remaining 598 bitcoin is worth to either side.
UPDATE, MON SEP 7, 1:19 PM ET. 3,400 bitcoin went back.
At 12:09 PM ET, in Bitcoin block 965,950, the address holding the coins sent 3,400.00000000 bitcoin to the Liquid federation’s wallet. Every input on that transaction is theirs. Two outputs, no ambiguity: 3,400 across, 598.49955894 kept as change, a fee of 1,768 satoshis.
The federation’s wallet went from 197.47 bitcoin this morning to 3,597.47193204 at block 965,950. The sender kept 598.49955894 as change on that transaction. We read both on two independent explorers and they agree to the satoshi. That is roughly 85% of what walked out on Sunday.
We cannot tell you why 3,400, and neither can anyone else. At 8:43 AM ET, block 965,930, the sender wrote “plz confirm again that we are sending the coins back to bc1qdlld6…” and attached a PGP block headed “More details about the vuln fix”. At 11:31 AM, block 965,948, they sent the federation a message encrypted end to end with no plaintext at all. Thirty-eight minutes after that, the money moved. Whatever was agreed is inside that encryption. Bounty, first tranche, percentage — anyone naming it is guessing.
One thing the arithmetic does say. The round number is on the way out, not on what stayed behind. They sent exactly 3,400.00000000 and kept an ugly 598.49955894. A negotiated percentage leaves a clean remainder. This leaves a clean payment. What was agreed was the figure to return.
And a warning, because this is where people lose coins. Three messages arrived at the federation’s wallet this morning claiming white-hat control and pointing readers at a different address. None of them came from the wallet holding the money. Eight more sit unconfirmed from eight separate senders, including one that accuses named Blockstream staff of running the hack and another selling a memecoin. The messages that matter are signed by the address holding 3,400 bitcoin an hour ago. Everything else attached to that wallet is somebody talking.
UPDATE, MON SEP 7, 10:29 AM ET. The condition was answered overnight.
At 7:46 AM ET, block 965,922, Blockstream sent a PGP-signed message to the address holding the coins: “Bridge nodes are patched, safe to return the funds.” At 8:43 AM, block 965,930, the reply asked for one more confirmation of where to send them, attaching a PGP block headed “More details about the vuln fix.” As of block 965,942 nobody has answered that question, and the 3,998.4996 bitcoin have not moved.
Which leaves the thing this story has been checking since midnight. The public code has not moved either. Elements still has no release since 23.3.3 on April 13. The newest commits are still a build-script fix from September 4 and an RPC fix from September 1. The security advisory list is still empty.
The condition, in the words of the people holding the money, was to make sure every node is patched. The answer covers bridge nodes, which are the federation’s own machines. From what we can tell those are not the same thing, and Liquid is a federation of more than eighty members on top of anyone else running the software.
Patching your own infrastructure first and publishing after is how responsible disclosure is supposed to work. We are not suggesting otherwise. We are saying that right now the fix exists on Blockstream’s machines and in no place a node operator can go and get it, and that the difference is checkable by anyone in a minute.
One point from the overnight read still stands: mempool developer Mononaut named the risk if the bug minted L-BTC from nothing — “if it’s an inflation bug, the L-BTC is no longer in limited supply.”
UPDATE, MON SEP 7, 12:08 AM ET. The people holding the coins say the bug is still live.
Blockstream told CoinDesk it found that a software bug in Elements had created some of the bitcoin involved. That answers the question this story left open at 5:52 PM: where the 4,000 L-BTC came from. Not a stolen key. Coins that were never supposed to exist, walked out through a working front door.
Then the chain said more than the statements did. Three messages sit in the Liquid federation’s own bitcoin wallet, every one of them sent from bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte — the address holding 3,998.4985 bitcoin right now. Whoever signed them controls the money. That is not a claim, it is a signature.
At 2:30 PM ET, block 965,818: “we are whitehats. contact us on chain.” At 10:20 PM, block 965,869: “sending most back to bc1qdlld6…, is that ok.” At 11:30 PM, block 965,875, carrying 1,512 bytes encrypted to Blockstream’s published PGP key: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
They offered to give it back, then made giving it back conditional on the patch.
Blockstream was answering the whole time, and this story said otherwise. Three messages come back from bc1qn8mgsmxx42j3fflqfkh0cqhdd6mj4h9q2mfqym. At 3:31 PM ET, block 965,822: “Please contact security@blockstream.com.” At 9:49 PM, block 965,865, a message encrypted to the attacker’s own key. At 11:30 PM, block 965,875, PGP-signed, two words: “Yes, thank you.”
We wrote at 12:08 AM that we could not find a reply. We searched the federation’s wallet. Blockstream was writing to the attacker’s address, which is where anyone would write back. Our mistake, corrected at the foot of this page.
Samson Mow published the sequence with links and caught the part that matters most, which we had missed. Blockstream’s “Yes, thank you” landed in the same block as “fix the bug first,” but it answers the offer from an hour earlier, not the condition. Nobody has answered the condition.
Here is the part anyone can check and nobody is checking. As of 12:08 AM ET the Elements repository has shipped nothing. Last release 23.3.3, April 13. The last three commits are a build fix for a Qt download link on September 4 and an RPC error fix on September 1. The security advisory list is empty.
A code repository and an attacker’s signed message are not friendly witnesses. Tonight they say the same thing.
UPDATE, 5:52 PM ET. The federation paused it.
Liquid Network’s statement confirms roughly 4,000 bitcoin and adds the part that matters: the coins left through the SideSwap Peg-out Authorization Key, and “that key was not compromised, nor were any others.” Bridge nodes are disabled. No new transactions can be submitted. “Effectively the Liquid sidechain is paused until this issue is resolved.” Other Liquid assets, USDT and DePix and the RWAs, are unaffected. Exchanges have paused L-BTC deposits and withdrawals.
Our 3:32 PM finding stands as written. The chain was live then, tip one minute old, and we said the federation had not halted it and that was a decision somebody made. Ninety minutes later they made the other decision.
SideSwap filled in the middle. At 14:05 UTC a customer sent them 4,000 L-BTC. They processed it like any other order, burned the L-BTC with a valid peg-out authorisation, and at 14:28 UTC the Federation paid out 3,996 bitcoin.
Read the three statements together. Nothing was stolen in the way people mean by the word. Every signature was good. The customer was a customer, the key was valid, and eleven of fifteen keys did what they are supposed to do. The whole question is where those 4,000 L-BTC came from before they were handed over.
Samson Mow says the working theory is Liquid’s Confidential Transactions, a node-level issue, not the PAKs and not the HSMs, and that developers cannot confirm it yet.
Confidential Transactions hide amounts. That is the feature. It is also why nobody saw this by watching the chain. Where amounts are hidden, supply cannot be audited by looking. The only honest number is the bitcoin sitting on the public side of the peg, which is the one we read at 3:32, and it says 207.
Liquid’s statement tells people to monitor the situation at mempool’s liquid.network. Read it the way our own correction says to read it. The Liquid index is still frozen at block 4,050,335 from 13:52 UTC, eight hours stale as of 6:08 PM ET, so the 4,205.02 L-BTC in circulation is the pre-drain number. The federation holdings figure reads the Bitcoin chain live and says 197.47 BTC, as of Bitcoin block 965,836. Two numbers, two clocks, one page.
UPDATE, 4:15 PM ET. mempool.space’s Liquid federation audit puts the arithmetic on one screen. 4,205.02 L-BTC are in circulation by its last Liquid read (block 4,050,335, where its index is stalled), and the federation’s wallet on the Bitcoin chain — which the audit reads live — holds 197.47 BTC against them, as of Bitcoin block 965,827. For every 1 L-BTC out there, the wallet behind it holds about 0.047 bitcoin. That is 4.696% backing, our arithmetic from their two figures. The audit also shows the two documented paths for coins to leave the federation untouched: Emergency Keys, zero usages; timelock-expired UTXOs, zero.
At the time of this writing, bitcoin was $78,366 (Crypto.com, 3:48 PM ET, Sep 8).
KEY RECEIPTS
UPDATE TUE SEP 8, 3:48 PM ET — the official incident report. Source: Liquid Network (@Liquid_BTC, verified), incident report posted ~19:10 UTC Sep 8. Company statement, printed as one; NOT verified against our own chain reads, and we could not independently load the post from here, so it is cited by name and time, not linked. Claims: unbacked ~4,000 L-BTC created Sep 6 15:53:10 UTC, Liquid block 4,050,336 — which does NOT reconcile with fellow Federation member SideSwap’s own timeline (customer sent 4,000 L-BTC 14:05 UTC; Federation paid 3,996 BTC 14:28 UTC), i.e. spent ~85 minutes before minted; flagged, not called a lie, query out. Bug named: Elements range-proof-verification caching flaw. Remediation: functionaries will “restore the corrected network state, including rejection of the invalid peg-out” — a correction of the LIQUID ledger state, NOT a reversal of any Bitcoin-chain transaction. Emergency Elements v23.3.4 in ~48 hours (prior release 23.3.3, Apr 13). Bridge nodes patched Sep 7 01:09 UTC (8h32m before the 09:41 UTC “safe to return” message per Galaxy). Blockstream official comms now say “the white hat hacker.” Confirmed, consistent with this page: reserve 4,205→197; no keys compromised; peg-out worked as designed; other assets unaffected but frozen; 3,400 BTC returned Sep 7 16:09:25 UTC; outstanding called 15% by Liquid vs our chain read of 598.49987177 BTC at the holding address (last moved Sep 8 02:41 UTC); the 4,205→197 fall included ~8 BTC of ordinary peg-outs before halt.
UPDATE TUE SEP 8, 9:02 AM ET — the halt and the two-way traffic. Blockstream’s own Liquid explorer, read 12:38 UTC and re-verified by us 12:44–13:02 UTC: Liquid tip block 4,051,232, last block 2026-09-07 04:49:10 UTC, ~1,915 minutes past the one-minute interval; 287 queued, next block 99.74% full. Proof of Reserves panel: Federation BTC Holdings 207.32500781 BTC, last change 2026-09-06 16:27:10, Assets vs Liabilities 105.083% — pre-return, stale. mempool.space federation audit: 4,205.02 L-BTC (stalled Liquid index) against 3,597.47199026 BTC in the federation wallet on the Bitcoin chain = 85.55%, our arithmetic. Both pages half stale; the only live-and-verifiable figure is the Bitcoin-side wallet. Federation wallet 3,597.47199026 BTC and holding address bc1ql4mfu6… 598.4999 BTC re-read on Blockstream’s Bitcoin explorer at 12:44 UTC; Bitcoin tip 966,076. Dialog blocks 966,023 (06:02:24 UTC) and 966,052 (09:41:24 UTC) confirmed on chain by us; the message sizes, direction and the 193-payment / 143-sender / 184-OP_RETURN sweep are Galaxy Research’s reconstruction (Alex Thorn, @glxyresearch, posted 11:07 UTC / 7:07 AM ET Sep 8), credited and linked, not rebuilt here. Holding-address figure 598.49987177 BTC as of last movement 02:41 UTC; live balance drifts on inbound dust. Bitcoin $78,386.96 on Blockstream’s explorer at 12:38 UTC; price line from Crypto.com.
UPDATE MON SEP 7, 9:57 PM ET — Blockstream statement, @Blockstream (verified), posted 6:00 PM ET Sep 7: updated software deployed, the federation preparing a coordinated restart, further hardening ongoing, assets to be returned. Confirmed on Blockstream’s verified X account; a company statement, printed as one, not chain-verified.
UPDATE MON SEP 7, 6:05 PM ET — the network status: Blockstream and Samson Mow, posted 4:33 PM ET Sep 7. Network paused; a chain split to be resolved before restart; Liquid wallets and services affected; do not send bitcoin to Liquid peg-in addresses until restart is confirmed; approximately 598 BTC outstanding; Blockstream continues to engage. That paragraph is the only thing on this page not verified against the Bitcoin chain, because there is nothing on-chain to verify. It is a statement, printed as one. Chain read 6:05 PM ET, mempool.space only: bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte, confirmed 598.49976050 BTC over 12 UTXOs, one unconfirmed 320-satoshi input, net +20,156 satoshis against the 12:09 PM change output. Single explorer, not the two-source agreement we held the 12:09 PM transaction to.
UPDATE MON SEP 7, 2:51 PM ET — the two-way exchange: Blockstream reply, txid 136612fc5618e33c4ae45753a759ac61014fae3133180bd2dc6f10f5856cbd78, block 965,956, 17:54:45 UTC, all inputs from bc1q57fqwl04n6fsnyd579zs7nlzywzsr5ftv5es49 (a wallet new to this exchange), PGP-signed with an encrypted body. Sender reply, txid fcd06c1bcb38e4c3eaf71c1137d7bdf935363ae3c14b590d5d1a501e326d2b99, block 965,962, 18:35:17 UTC, all inputs from bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte, 1,000 sats to the federation wallet. The reply SPENDS an output of the Blockstream transaction, which is checkable by anyone and is why we call it a reply rather than the next message. Earlier and confirmed today: txid 87dc0a20099a94c2caaa3fa93d1724cfe41b05ae5e0778cc0e8994b22e81120c, block 965,922, 11:46:42 UTC, from bc1qn8mgsmxx42j3fflqfkh0cqhdd6mj4h9q2mfqym, plaintext “Bridge nodes are patched, safe to return the funds.” Timeline first published by Samson Mow; every txid above re-verified against the chain before printing.
UPDATE MON SEP 7, 1:19 PM ET — the return: txid a6d697a25266ce3c78774fd1d75f896b7af522ada209b0f6228ea497bc49a46d, Bitcoin block 965,950, 16:09:25 UTC. All 15 inputs from bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte; outputs 3,400.00000000 BTC to bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr and 598.49955894 BTC change; fee 0.00001768 BTC. Federation balance at block 965,950, read on mempool.space and blockstream.info and identical on both: 3,597.47193204 BTC, against 197.47187814 BTC earlier the same day. The sender’s live balance is deliberately not quoted: that address receives unsolicited dust continuously and moved 546 sats within eighteen minutes of our first read. The 598.49955894 BTC figure above is the change output of the return transaction, which cannot change. Preceding messages, both from the sender: block 965,930 (16:43:33 UTC) “plz confirm again that we are sending the coins back…” plus a PGP block; block 965,948 (15:31:46 UTC) PGP, no plaintext. The three “white hats” messages at blocks 965,918 and 965,919 were sent from addresses OTHER than the one holding the coins and are not treated here as statements by it. UPDATE SUN SEP 6, 5:52 PM ET — the statements: Liquid Network, Sep 6: ~4,000 BTC ($320M) withdrawn via the SideSwap PAK; “that key was not compromised, nor were any others”; bridge nodes disabled; sidechain effectively paused; USDT, DePix and RWAs unaffected; exchanges pausing L-BTC.
SideSwap, Sep 6: a customer sent 4,000 L-BTC at 14:05 UTC; burned with a valid peg-out authorisation; the Federation paid 3,996 BTC at 14:28 UTC.
Samson Mow, Sep 6: working theory is Confidential Transactions, node level, not PAKs or HSMs; devs cannot confirm.
The Block, published 5:14 PM ET Sep 6, carries the pause and the uncompromised-key line.
Watch address in Liquid’s statement: bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr
UPDATE SUN SEP 6, 4:15 PM ET: mempool.space federation audit — L-BTC in circulation 4,205.02 (as of Liquid block 4,050,335, its stalled index); federation BTC holdings 197.47184268 BTC (as of Bitcoin block 965,827); 197.47 ÷ 4,205.02 = 4.696% backing, our arithmetic. Emergency Keys: 0 usages. Timelock-expired UTXOs: 0 (0.00000 BTC). The audit’s holdings figure is keyed to Bitcoin blocks; per SideSwap the payout confirmed at 14:28 UTC (10:28 AM ET), so the page carried the shortfall from then. Derived from the page’s own labeling, not observed. Our earlier 12:58 PM ET figure came from a post timestamp that rendered in Arizona time and is withdrawn. Blockstream API re-read 4:14 PM ET: peg unchanged at 207.2750 BTC; net of burns its ledger says 197.2472 L-BTC — mempool’s live wallet count (197.47) and Blockstream’s ledger arithmetic (197.25) are different measurements a quarter-coin apart, printed separately. Liquid tip 4,050,717, still on a 60-second cadence.
Blockstream Liquid API, read 2026-09-06 19:32 UTC: peg_in_amount 1,835,687,853,979 sats = 18,356.8785 BTC; peg_out_amount 1,814,960,353,198 sats = 18,149.6035 BTC; burned_amount 1,002,779,324 sats = 10.0278 BTC.
Remaining in peg: 207.2750 BTC. L-BTC circulating after burns: 197.2472 BTC.
Prior peg balance 4,205.0188 BTC (mempool.space snapshot, last updated at Liquid block 4,050,335, 13:52:10 UTC).
Delta: 3,997.7438 BTC, about $319.1M at $79,819.99.
Liquid chain tip at 19:31:10 UTC: block 4,050,675, one minute old. Chain live.
mempool.space Liquid tip: block 4,050,335, 340 blocks and 5h39m behind, while its Bitcoin tip is current at 965,822. Its Liquid indexer is stalled.
Bitcoin tip 965,822 at 19:31:47 UTC.
Federation is 11-of-15 multisig. On-chain message: “we are whitehats. contact us on chain.” (news.bitcoin.com, published 3:17 PM ET)
No statement from Blockstream, Liquid or Adam Back as of 3:17 PM ET.
10,417 peg-out events over the chain’s life.
UPDATE MON SEP 7, 12:08 AM ET — the Elements attribution and the chain messages:
CoinDesk, Omkar Godbole, stamped 03:43 UTC Sep 7 (11:43 PM ET Sep 6): “Later, Blockstream found that a software bug had created some of the bitcoin involved in a system called Elements.” Also: SideSwap “couldn’t tell which coins came from the bug and which were real, so it treated them all the same”; federation is “more than 80 exchanges, infrastructure firms and asset managers.” No Blockstream primary located — this is CoinDesk’s restatement, not a Blockstream quote.
On-chain, read from mempool.space at Bitcoin tip 965,879: three OP_RETURN messages in the federation wallet bc1qdlld6…, all sent from bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte. Blocks 965,818 (2:30 PM ET), 965,869 (10:20 PM ET), 965,875 (11:30 PM ET).
Sender balance 3,998.49852128 BTC across 31 transactions — the sender holds the drained funds, which is how the messages are attributed. Federation wallet balance 197.47187268 BTC, matching the audit figure in this story.
ElementsProject/elements read 12:08 AM ET Sep 7: latest release elements-23.3.3 published 2026-04-13; latest commits c7e856fa and 7fd79014 (Qt download link, Sep 4) and 4ddaefc8 (RPC returns, Sep 1); security-advisories endpoint returns an empty list.
AMOUNTS DISAGREE ACROSS SOURCES, stated as a range: 4,019 (Cointurk), ~4,000 (CoinDesk and Liquid), 3,996 paid out (SideSwap), 3,997.74 (our derived peg delta), 3,998.4985 (on-chain balance of the holding address). We do not pick one silently.
NOT CLAIMED: that the bug is Confidential Transactions — Samson Mow said CT and deleted the post, Blockstream via CoinDesk says a bug in Elements, and those are not the same claim. Not claimed: why that post was deleted. Not claimed: that the funds are safe or lost. CORRECTED — Blockstream’s on-chain replies exist. Three, all from bc1qn8mgsmxx42j3fflqfkh0cqhdd6mj4h9q2mfqym, sent to the attacker’s address rather than the federation wallet we searched: block 965,822 (3:31 PM ET) “Please contact security@blockstream.com”; block 965,865 (9:49 PM ET) an Electrum BIE1 ECIES message encrypted to the attacker’s key; block 965,875 (11:30 PM ET) PGP-signed “Yes, thank you.” Six-message sequence and txids read from mempool.space at Bitcoin tip 965,885; all six txids match those published by Samson Mow. The reading that the “Yes” answers the 10:20 PM offer and not the 11:27 PM condition is Mow’s, credited in the copy. Attacker balance 3,998.4985 BTC, funds unmoved; the exact figure drifts by a few hundred sats because unrelated parties keep sending dust with advertising attached to that address.
Re-verified at push, 19:48–19:53 UTC (3:48–3:53 PM ET): peg unchanged at 207.2750 BTC; Blockstream tip 4,050,690 with the newest block 42 seconds old on a 60-second cadence; mempool.space’s Liquid tip still 4,050,335, now about 355 blocks behind. No public statement found from Blockstream or Adam Back.
UPDATE TUE SEP 8, 3:48 PM ET — the official incident report. Source: Liquid Network (@Liquid_BTC, verified), incident report posted ~19:10 UTC Sep 8. Company statement, printed as one; NOT verified against our own chain reads, and we could not independently load the post from here, so it is cited by name and time, not linked. Claims: unbacked ~4,000 L-BTC created Sep 6 15:53:10 UTC, Liquid block 4,050,336 — which does NOT reconcile with fellow Federation member SideSwap’s own timeline (customer sent 4,000 L-BTC 14:05 UTC; Federation paid 3,996 BTC 14:28 UTC), i.e. spent ~85 minutes before minted; flagged, not called a lie, query out. Bug named: Elements range-proof-verification caching flaw. Remediation: functionaries will “restore the corrected network state, including rejection of the invalid peg-out” — a correction of the LIQUID ledger state, NOT a reversal of any Bitcoin-chain transaction. Emergency Elements v23.3.4 in ~48 hours (prior release 23.3.3, Apr 13). Bridge nodes patched Sep 7 01:09 UTC (8h32m before the 09:41 UTC “safe to return” message per Galaxy). Blockstream official comms now say “the white hat hacker.” Confirmed, consistent with this page: reserve 4,205→197; no keys compromised; peg-out worked as designed; other assets unaffected but frozen; 3,400 BTC returned Sep 7 16:09:25 UTC; outstanding called 15% by Liquid vs our chain read of 598.49987177 BTC at the holding address (last moved Sep 8 02:41 UTC); the 4,205→197 fall included ~8 BTC of ordinary peg-outs before halt.
UPDATE TUE SEP 8, 9:02 AM ET — the halt and the two-way traffic. Blockstream’s own Liquid explorer, read 12:38 UTC and re-verified by us 12:44–13:02 UTC: Liquid tip block 4,051,232, last block 2026-09-07 04:49:10 UTC, ~1,915 minutes past the one-minute interval; 287 queued, next block 99.74% full. Proof of Reserves panel: Federation BTC Holdings 207.32500781 BTC, last change 2026-09-06 16:27:10, Assets vs Liabilities 105.083% — pre-return, stale. mempool.space federation audit: 4,205.02 L-BTC (stalled Liquid index) against 3,597.47199026 BTC in the federation wallet on the Bitcoin chain = 85.55%, our arithmetic. Both pages half stale; the only live-and-verifiable figure is the Bitcoin-side wallet. Federation wallet 3,597.47199026 BTC and holding address bc1ql4mfu6… 598.4999 BTC re-read on Blockstream’s Bitcoin explorer at 12:44 UTC; Bitcoin tip 966,076. Dialog blocks 966,023 (06:02:24 UTC) and 966,052 (09:41:24 UTC) confirmed on chain by us; the message sizes, direction and the 193-payment / 143-sender / 184-OP_RETURN sweep are Galaxy Research’s reconstruction (Alex Thorn, @glxyresearch, posted 11:07 UTC / 7:07 AM ET Sep 8), credited and linked, not rebuilt here. Holding-address figure 598.49987177 BTC as of last movement 02:41 UTC; live balance drifts on inbound dust. Bitcoin $78,386.96 on Blockstream’s explorer at 12:38 UTC; price line from Crypto.com.
UPDATE MON SEP 7, 9:57 PM ET — Blockstream statement, @Blockstream (verified), posted 6:00 PM ET Sep 7: updated software deployed, the federation preparing a coordinated restart, further hardening ongoing, assets to be returned. Confirmed on Blockstream’s verified X account; a company statement, printed as one, not chain-verified.
UPDATE MON SEP 7, 6:05 PM ET — the network status: Blockstream and Samson Mow, posted 4:33 PM ET Sep 7. Network paused; a chain split to be resolved before restart; Liquid wallets and services affected; do not send bitcoin to Liquid peg-in addresses until restart is confirmed; approximately 598 BTC outstanding; Blockstream continues to engage. That paragraph is the only thing on this page not verified against the Bitcoin chain, because there is nothing on-chain to verify. It is a statement, printed as one. Chain read 6:05 PM ET, mempool.space only: bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte, confirmed 598.49976050 BTC over 12 UTXOs, one unconfirmed 320-satoshi input, net +20,156 satoshis against the 12:09 PM change output. Single explorer, not the two-source agreement we held the 12:09 PM transaction to.
UPDATE MON SEP 7, 2:51 PM ET — the two-way exchange: Blockstream reply, txid 136612fc5618e33c4ae45753a759ac61014fae3133180bd2dc6f10f5856cbd78, block 965,956, 17:54:45 UTC, all inputs from bc1q57fqwl04n6fsnyd579zs7nlzywzsr5ftv5es49 (a wallet new to this exchange), PGP-signed with an encrypted body. Sender reply, txid fcd06c1bcb38e4c3eaf71c1137d7bdf935363ae3c14b590d5d1a501e326d2b99, block 965,962, 18:35:17 UTC, all inputs from bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte, 1,000 sats to the federation wallet. The reply SPENDS an output of the Blockstream transaction, which is checkable by anyone and is why we call it a reply rather than the next message. Earlier and confirmed today: txid 87dc0a20099a94c2caaa3fa93d1724cfe41b05ae5e0778cc0e8994b22e81120c, block 965,922, 11:46:42 UTC, from bc1qn8mgsmxx42j3fflqfkh0cqhdd6mj4h9q2mfqym, plaintext “Bridge nodes are patched, safe to return the funds.” Timeline first published by Samson Mow; every txid above re-verified against the chain before printing.
UPDATE MON SEP 7, 1:19 PM ET — the return: txid a6d697a25266ce3c78774fd1d75f896b7af522ada209b0f6228ea497bc49a46d, Bitcoin block 965,950, 16:09:25 UTC. All 15 inputs from bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte; outputs 3,400.00000000 BTC to bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr and 598.49955894 BTC change; fee 0.00001768 BTC. Federation balance at block 965,950, read on mempool.space and blockstream.info and identical on both: 3,597.47193204 BTC, against 197.47187814 BTC earlier the same day. The sender’s live balance is deliberately not quoted: that address receives unsolicited dust continuously and moved 546 sats within eighteen minutes of our first read. The 598.49955894 BTC figure above is the change output of the return transaction, which cannot change. Preceding messages, both from the sender: block 965,930 (16:43:33 UTC) “plz confirm again that we are sending the coins back…” plus a PGP block; block 965,948 (15:31:46 UTC) PGP, no plaintext. The three “white hats” messages at blocks 965,918 and 965,919 were sent from addresses OTHER than the one holding the coins and are not treated here as statements by it. UPDATE SUN SEP 6, 5:52 PM ET — the statements: Liquid Network, Sep 6: ~4,000 BTC ($320M) withdrawn via the SideSwap PAK; “that key was not compromised, nor were any others”; bridge nodes disabled; sidechain effectively paused; USDT, DePix and RWAs unaffected; exchanges pausing L-BTC.
SideSwap, Sep 6: a customer sent 4,000 L-BTC at 14:05 UTC; burned with a valid peg-out authorisation; the Federation paid 3,996 BTC at 14:28 UTC.
Samson Mow, Sep 6: working theory is Confidential Transactions, node level, not PAKs or HSMs; devs cannot confirm.
The Block, published 5:14 PM ET Sep 6, carries the pause and the uncompromised-key line.
Watch address in Liquid’s statement: bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr
UPDATE SUN SEP 6, 4:15 PM ET: mempool.space federation audit — L-BTC in circulation 4,205.02 (as of Liquid block 4,050,335, its stalled index); federation BTC holdings 197.47184268 BTC (as of Bitcoin block 965,827); 197.47 ÷ 4,205.02 = 4.696% backing, our arithmetic. Emergency Keys: 0 usages. Timelock-expired UTXOs: 0 (0.00000 BTC). The audit’s holdings figure is keyed to Bitcoin blocks; per SideSwap the payout confirmed at 14:28 UTC (10:28 AM ET), so the page carried the shortfall from then. Derived from the page’s own labeling, not observed. Our earlier 12:58 PM ET figure came from a post timestamp that rendered in Arizona time and is withdrawn. Blockstream API re-read 4:14 PM ET: peg unchanged at 207.2750 BTC; net of burns its ledger says 197.2472 L-BTC — mempool’s live wallet count (197.47) and Blockstream’s ledger arithmetic (197.25) are different measurements a quarter-coin apart, printed separately. Liquid tip 4,050,717, still on a 60-second cadence.
Blockstream Liquid API, read 2026-09-06 19:32 UTC: peg_in_amount 1,835,687,853,979 sats = 18,356.8785 BTC; peg_out_amount 1,814,960,353,198 sats = 18,149.6035 BTC; burned_amount 1,002,779,324 sats = 10.0278 BTC.
Remaining in peg: 207.2750 BTC. L-BTC circulating after burns: 197.2472 BTC.
Prior peg balance 4,205.0188 BTC (mempool.space snapshot, last updated at Liquid block 4,050,335, 13:52:10 UTC).
Delta: 3,997.7438 BTC, about $319.1M at $79,819.99.
Liquid chain tip at 19:31:10 UTC: block 4,050,675, one minute old. Chain live.
mempool.space Liquid tip: block 4,050,335, 340 blocks and 5h39m behind, while its Bitcoin tip is current at 965,822. Its Liquid indexer is stalled.
Bitcoin tip 965,822 at 19:31:47 UTC.
Federation is 11-of-15 multisig. On-chain message: “we are whitehats. contact us on chain.” (news.bitcoin.com, published 3:17 PM ET)
No statement from Blockstream, Liquid or Adam Back as of 3:17 PM ET.
10,417 peg-out events over the chain’s life.
UPDATE MON SEP 7, 12:08 AM ET — the Elements attribution and the chain messages:
CoinDesk, Omkar Godbole, stamped 03:43 UTC Sep 7 (11:43 PM ET Sep 6): “Later, Blockstream found that a software bug had created some of the bitcoin involved in a system called Elements.” Also: SideSwap “couldn’t tell which coins came from the bug and which were real, so it treated them all the same”; federation is “more than 80 exchanges, infrastructure firms and asset managers.” No Blockstream primary located — this is CoinDesk’s restatement, not a Blockstream quote.
On-chain, read from mempool.space at Bitcoin tip 965,879: three OP_RETURN messages in the federation wallet bc1qdlld6…, all sent from bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte. Blocks 965,818 (2:30 PM ET), 965,869 (10:20 PM ET), 965,875 (11:30 PM ET).
Sender balance 3,998.49852128 BTC across 31 transactions — the sender holds the drained funds, which is how the messages are attributed. Federation wallet balance 197.47187268 BTC, matching the audit figure in this story.
ElementsProject/elements read 12:08 AM ET Sep 7: latest release elements-23.3.3 published 2026-04-13; latest commits c7e856fa and 7fd79014 (Qt download link, Sep 4) and 4ddaefc8 (RPC returns, Sep 1); security-advisories endpoint returns an empty list.
AMOUNTS DISAGREE ACROSS SOURCES, stated as a range: 4,019 (Cointurk), ~4,000 (CoinDesk and Liquid), 3,996 paid out (SideSwap), 3,997.74 (our derived peg delta), 3,998.4985 (on-chain balance of the holding address). We do not pick one silently.
NOT CLAIMED: that the bug is Confidential Transactions — Samson Mow said CT and deleted the post, Blockstream via CoinDesk says a bug in Elements, and those are not the same claim. Not claimed: why that post was deleted. Not claimed: that the funds are safe or lost. CORRECTED — Blockstream’s on-chain replies exist. Three, all from bc1qn8mgsmxx42j3fflqfkh0cqhdd6mj4h9q2mfqym, sent to the attacker’s address rather than the federation wallet we searched: block 965,822 (3:31 PM ET) “Please contact security@blockstream.com”; block 965,865 (9:49 PM ET) an Electrum BIE1 ECIES message encrypted to the attacker’s key; block 965,875 (11:30 PM ET) PGP-signed “Yes, thank you.” Six-message sequence and txids read from mempool.space at Bitcoin tip 965,885; all six txids match those published by Samson Mow. The reading that the “Yes” answers the 10:20 PM offer and not the 11:27 PM condition is Mow’s, credited in the copy. Attacker balance 3,998.4985 BTC, funds unmoved; the exact figure drifts by a few hundred sats because unrelated parties keep sending dust with advertising attached to that address.
Re-verified at push, 19:48–19:53 UTC (3:48–3:53 PM ET): peg unchanged at 207.2750 BTC; Blockstream tip 4,050,690 with the newest block 42 seconds old on a 60-second cadence; mempool.space’s Liquid tip still 4,050,335, now about 355 blocks behind. No public statement found from Blockstream or Adam Back.
THE PEG HOLDS 207 COINS. THE CHAIN KEEPS TICKING.
CORRECTION · 2026-09-06: An earlier version said mempool.space’s stalled explorer “still shows 4,205 bitcoin in the peg” and that a reader checking there would see a full peg and conclude nothing happened. Wrong, and it undersold the source: only mempool’s Liquid-side index is frozen at block 4,050,335. Its federation audit reads the Bitcoin chain live, showed 197.47 BTC against 4,205.02 L-BTC, and carried the shortfall from the time the payout confirmed at 14:28 UTC (10:28 AM ET per SideSwap), hours before the first story ran. Caught by the editor.
Amended later the same day: this notice first cited 12:58 PM ET for when mempool’s audit showed the shortfall. That came from a post timestamp rendered in Arizona time and is withdrawn; the sourced anchor is the 14:28 UTC payout. Separately, a 5:52 PM update repeated the retracted “full peg” phrasing this notice retracts. Cut the same evening. SECOND CORRECTION · 2026-09-07: this story said we could not locate a Blockstream on-chain reply. Wrong. Three replies exist. We searched the federation’s wallet when Blockstream was writing to the attacker’s address. All three are now in the copy with their blocks and times. The reading that Blockstream’s “Yes, thank you” answers the 10:20 PM offer and not the 11:27 PM patch condition is Samson Mow’s, credited above. Caught on a second pass after Mow published his summary.
UPDATE 10:29 AM ET — the patch answer. Read from mempool.space at Bitcoin tip 965,942: block 965,922 (7:46 AM ET) Blockstream, PGP-signed, “Bridge nodes are patched, safe to return the funds”; block 965,930 (8:43 AM ET) the holders ask for re-confirmation of the destination and attach a PGP block headed “More details about the vuln fix”; no reply as of 965,942. Attacker balance 3,998.4996 BTC and federation balance 197.4719 BTC, both unchanged from the overnight reading apart from inbound advertising dust; both mempools empty; no output over 1 BTC has left the attacker address. ElementsProject/elements re-read the same morning: latest release still elements-23.3.3 (2026-04-13), newest commits still the Qt build-link fix (Sep 4) and the RPC fix (Sep 1), security-advisories endpoint still returns an empty list. NOT CLAIMED: that the incident is resolved, that the funds will be returned, that the bridge-node patch is or is not sufficient, or that anything is being concealed. The scope difference between “every node” and “bridge nodes” is our reading of what is observable, stated as such.
Amended later the same day: this notice first cited 12:58 PM ET for when mempool’s audit showed the shortfall. That came from a post timestamp rendered in Arizona time and is withdrawn; the sourced anchor is the 14:28 UTC payout. Separately, a 5:52 PM update repeated the retracted “full peg” phrasing this notice retracts. Cut the same evening. SECOND CORRECTION · 2026-09-07: this story said we could not locate a Blockstream on-chain reply. Wrong. Three replies exist. We searched the federation’s wallet when Blockstream was writing to the attacker’s address. All three are now in the copy with their blocks and times. The reading that Blockstream’s “Yes, thank you” answers the 10:20 PM offer and not the 11:27 PM patch condition is Samson Mow’s, credited above. Caught on a second pass after Mow published his summary.
UPDATE 10:29 AM ET — the patch answer. Read from mempool.space at Bitcoin tip 965,942: block 965,922 (7:46 AM ET) Blockstream, PGP-signed, “Bridge nodes are patched, safe to return the funds”; block 965,930 (8:43 AM ET) the holders ask for re-confirmation of the destination and attach a PGP block headed “More details about the vuln fix”; no reply as of 965,942. Attacker balance 3,998.4996 BTC and federation balance 197.4719 BTC, both unchanged from the overnight reading apart from inbound advertising dust; both mempools empty; no output over 1 BTC has left the attacker address. ElementsProject/elements re-read the same morning: latest release still elements-23.3.3 (2026-04-13), newest commits still the Qt build-link fix (Sep 4) and the RPC fix (Sep 1), security-advisories endpoint still returns an empty list. NOT CLAIMED: that the incident is resolved, that the funds will be returned, that the bridge-node patch is or is not sufficient, or that anything is being concealed. The scope difference between “every node” and “bridge nodes” is our reading of what is observable, stated as such.
Blockstream’s own Liquid explorer (primary) · Sun Sep 6 · verified 3:32 PM ET · + news.bitcoin.com
Terms in this story: Node