Actor Profile

Liquid Hackers is a group that exploited a vulnerability in the Elements software underlying the Liquid Network Bitcoin sidechain on September 6, 2026. The actors self-identify as "white hats" and communicated via on-chain messages, claiming their intent was to expose a critical flaw. They returned approximately 85% of the stolen funds (3,400 BTC) after Blockstream patched the vulnerability and confirmed the fix via signed blockchain messages. However, they retained approximately 598.5 BTC (~$47M), which may represent a negotiated reward or, as some security experts suggest, extortion. The group's true motivation remains ambiguous—while they demanded patching before returning funds, the retention of significant value challenges their white-hat claims.

TTPs (Tactics, Techniques, Procedures)

The attack leveraged a bug in the Elements software that allowed unauthorized creation of L-BTC tokens without corresponding bitcoin backing. The actors exploited SideSwap's Peg-out Authorization Key to execute a peg-out operation, destroying the fraudulently created L-BTC and releasing approximately 3,998 bitcoin from the Liquid Federation wallet to the main Bitcoin blockchain. Notably, the key itself was not compromised—the vulnerability resided in the Elements software logic. Post-exploitation, the actors used the Bitcoin blockchain as a covert communication channel, embedding plaintext and PGP-encrypted messages within transactions to negotiate with Blockstream. This demonstrates sophisticated OPSEC and knowledge of blockchain-based steganography. The attack does not map cleanly to traditional MITRE ATT&CK techniques due to its blockchain-specific nature, but parallels include T1190 (Exploit Public-Facing Application) for the initial vulnerability exploitation and T1071.001 (Application Layer Protocol) for C2 via blockchain transactions.

Targets & Patterns

The Liquid Hackers specifically targeted the Liquid Network, a Bitcoin sidechain operated by Blockstream that facilitates faster, more confidential bitcoin transactions and supports tokenized assets. The attack focused on the federation wallet holding bitcoin reserves backing L-BTC tokens, exploiting the trust model inherent in federated sidechains. The cryptocurrency and blockchain sectors are attractive targets due to the irreversible nature of blockchain transactions, high-value digital asset holdings, and complex smart contract/sidechain logic that may harbor exploitable flaws. This incident demonstrates targeting of Layer 2 scaling solutions and sidechain infrastructure rather than mainchain Bitcoin, reflecting adversary awareness of where custodial vulnerabilities exist. The 95% depletion of Liquid's bitcoin reserves (from ~4,200 to ~200 BTC) caused operational paralysis, preventing L-BTC holders from redeeming tokens—a denial-of-service effect alongside the theft.

Historical Context

This incident represents a novel attack vector against Bitcoin sidechain infrastructure rather than traditional exchange hacks or wallet compromises. Unlike previous high-profile cryptocurrency thefts (e.g., Mt. Gox, Poly Network), the Liquid Hackers exploited software logic flaws in the sidechain's peg mechanism rather than compromising cryptographic keys or social engineering operators. The partial return of funds (85%) echoes the 2021 Poly Network incident where an attacker returned $610M after claiming white-hat intentions, though that actor returned all funds and declined a bounty. The use of blockchain transactions for negotiation is consistent with on-chain communication tactics seen in ransomware and extortion cases within the cryptocurrency ecosystem. Blockstream's incident response—patching nodes before fund return and using signed on-chain messages—reflects maturation of cryptocurrency incident handling. The debate over whether the retained 598.5 BTC constitutes a legitimate bug bounty or extortion highlights ongoing tensions in defining responsible disclosure in decentralized finance contexts.

Defensive Recommendations

  • Implement comprehensive input validation and state verification for all peg-in/peg-out operations in sidechain and Layer 2 implementations to prevent unauthorized token creation or withdrawal
  • Deploy real-time monitoring for anomalous federation wallet transactions, including threshold alerts for withdrawals exceeding normal operational parameters (e.g., >10% of reserves)
  • Establish formal bug bounty programs with clear reward structures for blockchain infrastructure to provide legitimate disclosure channels and reduce ambiguity around white-hat activities
  • Conduct regular third-party security audits of sidechain bridge logic and consensus mechanisms, with particular focus on state transition validation and token supply integrity
  • Implement multi-signature emergency pause mechanisms with geographically and organizationally distributed keyholders to enable rapid response to detected anomalies without single points of failure