Market Incident
Public · Developing
4,000 BTC Stolen, Hackers Post Their Demands On Chain
On September 6th, a confidential transaction validation bug in the Liquid Network federation wallet was exploited, draining roughly 4,000 BTC. Of that amount, 600 coins are permanently lost. Additionally, Chilean exchange Orionx collapsed with $7 million in customer Bitcoin missing and over 100,000 withdrawals frozen.
Published:
Updated:
What happened
Liquid Network, a Bitcoin sidechain by Blockstream, was hit by a hack that drained about 4,000 BTC. The hackers returned 3,400 BTC after on-chain negotiations, keeping roughly 598 BTC as a bounty. Blockstream confirmed all bridge nodes were patched before the return.
Global impact / market context
This incident shows how vulnerable sidechains can be, and the return of funds may reduce panic. However, the kept funds and the collapse of Orionx highlight real losses for users and exchanges, affecting trust in Bitcoin-based systems.
What to watch
- Check whether Blockstream has detailed the exact exploit and patching to see if other sidechains are also at risk.
- Watch for updates on Orionx's collapse and whether users can recover their funds, as this reflects wider fallout.
- Monitor if any regulatory actions follow the hack or the bounty, as this could shape how future hacks are handled.
Affected assets
- BTCUSDT
Evidence
- X - cointelegraph — UPDATE: Liquid Network hackers have returned 3,400 BTC (85%) to the Federation wallet after negotiating on-chain with Blockstream. They kept ~598 BTC (~$47M) as an apparent bounty.
- BeInCrypto — Hackers Return 85% of Stolen Bitcoin from Last Week's Bridge Attack
- X - BSCNews — The negotiations were conducted entirely in OP_RETURN messages, ending with 3,400 BTC back in the federation wallet. The white hats held out until Blockstream confirmed that every bridge node was patched; about 4 hours later, they moved the coins but kept 598.5 BTC as a bounty.
- BTC Sessions — 4,000 BTC Stolen, Hackers Post Their Demands On Chain
- Incident timeline — UPDATE: Liquid Network hackers have returned 3,400 BTC (85%) to the Federation wallet after negotiating on-chain with Blockstream. They kept ~598 BTC (~$47M) as an apparent bounty.
- Incident timeline — Hackers Return 85% of Stolen Bitcoin from Last Week's Bridge Attack
- Incident timeline — The negotiations were conducted entirely in OP_RETURN messages, ending with 3,400 BTC back in the federation wallet. The white hats held out until Blockstream confirmed that every bridge node was patched; about 4 hours later, they moved the coins but kept 598.5 BTC as a bounty.
- Incident timeline — 4,000 BTC Stolen, Hackers Post Their Demands On Chain