Liquid Network Exploit: How 4,000 BTC Left a Multisig

On 6 September 2026, about 4,000 BTC — roughly $320 million — was withdrawn from the wallet that backs Blockstream's Liquid Network. No key was stolen. The wallet is an 11-of-15 multisig, and the signers signed, because the software told them the withdrawal was valid. That is the whole lesson of the Liquid Network exploit, and it applies to every bridge that holds assets on one chain and issues claims on another.

Key facts

• When: 6 September 2026, at 14:05 UTC.
• How much: about 4,000 BTC, from a federation wallet holding about 4,200.
• The cause: a bug in Elements, the open-source software Liquid runs, in how it cached the results of range-proof checks.
• What came back: 3,400 BTC was returned; 598.5 BTC, about $47 million, was not.
• The fix: Elements v23.3.4 shipped on 9 September, and the network resumed on 10 September.

What actually broke?

Liquid is a sidechain. You lock bitcoin with a federation of fifteen members and receive L-BTC on Liquid; when you want out, you return the L-BTC and the federation releases the bitcoin. The promise is that L-BTC exists only where bitcoin was locked.

Liquid hides transaction amounts, and it uses range proofs to check that a hidden amount is real — that nobody is creating coins out of nothing. The bug was in the cache that remembers which proofs have already been verified. It let the attackers create around 4,000 L-BTC that no bitcoin stood behind. Then they redeemed it through the normal exit, and the federation paid out real bitcoin against counterfeit claims.

Why didn't the multisig stop it?

Because a multisig guards keys, not rules.

Eleven of fifteen signers must agree before bitcoin leaves. They did agree, and correctly by their own lights: the withdrawal request was well formed and the chain said the L-BTC was valid. The check that failed was upstream of them. A threshold signature tells you that enough parties approved a transaction. It tells you nothing about whether the thing they approved was true.

This is the same shape as most large losses now. The contract or the multisig does what it was built to do, and the money leaves through the part nobody counted as the perimeter — which is the argument in why audited contracts still get drained.

Were the attackers really white hats?

They said so, and they returned 3,400 BTC. They also kept 598.5 BTC and described it as a bounty. Blockstream's position was blunt: "Taking assets without authorization and withholding their return is a crime, not responsible disclosure."

Whatever you call it, the reserve is short by the amount kept.

What should a user of any bridge take from this?

• A wrapped asset is a claim. L-BTC was a claim on a federation. A bridged token on any chain is a claim on whoever holds the original.
• Ask what validates a withdrawal, not only who signs it. Signers approve what the software shows them.
• Size the balance to the trust. Keep on a bridge what you are using there.

Nura Chain's bridged BNB and USDT are claims of exactly this kind: ordinary ERC-20 contracts minted by its bridge, whose supply you can read yourself with the Nura Chain explorer. Reading the supply tells you what was issued. It does not tell you what backs it, on Liquid or anywhere else.

Figures are as reported in the days after the incident; Blockstream publishes the account of record.