Liquid Network Hack Leaves $47 Million Loss After Bitcoin Return
Attackers stole 4,000 bitcoin from the Liquid Network, returned most of the funds after a patch and kept 598 coins worth about $47 million as a claimed bounty.
A weekend theft on the Liquid Network has left a smaller but still material loss after attackers returned most of roughly $320 million in stolen bitcoin and kept 598 coins as what they called a bounty.
SiliconANGLE reported that the breach began with 4,000 bitcoin taken from the Blockstream-backed sidechain, equal to about 95% of its Bitcoin reserve.
The partial return changed the immediate scale of the incident, but it did not erase the security question around SideSwap, the system used to move funds in and out of the network.
The Liquid Network is a layer-two Bitcoin network launched in 2018 by Blockstream.
Unlike Bitcoin's wider decentralized verification model, Liquid relies on about 80 organizations to verify payments, with about 15 active at any one time.
It also shields transaction values from public view and uses SideSwap to move assets between Liquid and other blockchains.
SideSwap sits at the center of the timeline because users enter Liquid by depositing bitcoin into the system.
Those coins are moved into a virtual vault, while users receive platform-specific stablecoins of equal value.
When users leave the network, SideSwap is supposed to return the bitcoin they deposited.
The contested mechanism is a peg-out authorization key, or PKA, used in that movement of cryptocurrency.
Liquid Network maintainers stated that the hackers used the PKA to steal the bitcoin, while also claiming the key itself was not compromised.
That leaves the incident framed less as a simple stolen-key case than as an exploit path through the withdrawal process.
SideSwap's developers wrote on X that the attackers exploited a flaw in Elements, the open-source project that underpins Liquid's centralized transaction approval workflow and other core sidechain features.
The attackers then embedded a public Bitcoin transaction-log message to Blockstream, saying they would return most of the cryptocurrency once the vulnerability was patched.
The patch-and-return sequence produced an unusual outcome for a crypto breach.
Most of the stolen reserve came back, other cryptocurrencies stored on the sidechain were not affected, and the attackers retained about $47 million worth of bitcoin.
The retained 598 coins remain the concrete loss after the emergency response.
The incident also lands in a market already dealing with recurring platform breaches.
Hackers stole an estimated $136.3 million across 50 cryptocurrency attacks in August, making Liquid's weekend compromise a reminder that sidechain design, bridge-like transfer systems and centralized approval layers can become the operational fault line even when the underlying Bitcoin network is not the target.
