Bitcoin network used by exchanges hit by $320 million exploit. Hackers claim they're the 'good guys'

# Bitcoin network used by exchanges hit by $320 million exploit. Hackers claim they're the 'good guys'

> Evidence tier: B1
> Evidence type: Independent digital-asset report with network and infrastructure-provider attribution
> Source: [CoinDesk](https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys)
> Published: 2026-09-07
> Captured: 2026-09-07T13:01:37.701Z

## Source summary

CoinDesk reports that Liquid Network paused new transactions after purported white-hat hackers withdrew roughly 4,000 of the approximately 4,200 BTC held in its federation wallet, worth about USD 320 million at the time. Blockstream attributed the incident to a bug in the Elements software rather than compromised keys, and the funds moved through SideSwap's authorised peg-out path. The party controlling the bitcoin said it would return the funds after the vulnerability was fixed, but Liquid had not announced a reopening time or confirmed a return by the article's latest update.

## Why it matters

Liquid is a settlement sidechain used by exchanges, infrastructure firms and asset managers, so the network pause is a concrete availability and reserve-integrity event for digital-asset settlement. The incident does not mean the Bitcoin mainnet was breached, and CoinDesk says other assets on Liquid were not affected. The roughly USD 320 million figure is a contemporaneous valuation rather than a confirmed permanent loss; the claimed white-hat status, full root cause, recovery amount and reopening time remained unresolved.

## Key numbers

- **Bitcoin withdrawn from the federation wallet:** roughly 4,000 BTC
- **Approximate value at the time:** about USD 320 million
- **Federation wallet balance before the incident:** approximately 4,200 BTC

## Topics and entities

- Industry lane: Web3 & stablecoin payments
- Entities: Liquid Network / Blockstream / SideSwap
- Web3 payments
- Payment infrastructure

## Evidence and credibility note

Independent CoinDesk report citing Liquid Network, Blockstream and SideSwap statements, with separate reporting by The Block. The pause and approximate amount are reported, but the actor's white-hat claim, eventual return, final loss, complete root cause and restoration timing were unresolved at publication.

Date evidence: Automatically verified from JSON-LD datePublished: 2026-09-07T03:43:12.716Z

## First-party corroboration

- [https://www.theblock.co/news/defi/2026-09-07-liquid-network-attacker-says-they-will-return-most-of-4000-btc-after-bug-fix-413673](/en/items/https://www.theblock.co/news/defi/2026-09-07-liquid-network-attacker-says-they-will-return-most-of-4000-btc-after-bug-fix-413673)

## Original-source traceback

[Open the original CoinDesk report](https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys)

---

This is a structured Payments Hot Markdown source summary derived from external reporting. Use the original link above to read the publisher's article; copyright remains with the original publisher.