The largest bitcoin incident of 2026 did not steal a key. It printed coins that should not have existed, walked them through a working peg-out, and left the reserve almost empty.

On September 6, at Liquid block 4,050,336 (13:53 UTC), a consensus bug in Elements — the Bitcoin-fork software Liquid runs — let a party mint about 4,000 unbacked L-BTC. At 14:05–14:06 UTC those tokens hit SideSwap’s peg-out desk. SideSwap burned them against a valid authorization. At 14:28 UTC the federation released about 3,996 BTC on the main chain. A smaller 2.5 BTC test peg-out had already gone out. Combined, roughly 3,998.5 BTC — about $320 million at the time — left the wallet that is supposed to back every L-BTC one-for-one. Reserves fell from about 4,200 BTC to 197 BTC. Ninety-five percent of the peg was gone in half an hour. Bitcoin L1 was untouched. USDT, DePix, and other Liquid-issued assets were not the bug. L-BTC was.

What broke

Liquid’s public line is consistent: no federation private key was compromised. SideSwap says the same about its peg-out authorization key and its own boxes. The peg-out machinery did what it was built to do. It accepted L-BTC that looked real.

The flaw sat in Elements’ handling of range-proof verification cache for confidential transactions — a cache-key collision, in reconstructions Blockstream has pointed at, that had lived in the master branch and had not been cleaned out of production nodes. Unbacked L-BTC passed as backed L-BTC. Eleven of fifteen federation signatures moved the main-chain coins because the authorization path was valid. That is a worse failure mode than a stolen laptop. The signers were honest. The asset they signed for was fake.

Bridge nodes went down around 20:25 UTC. The network paused. Exchanges froze L-BTC deposits and withdrawals. SideSwap later returned its 0.1% peg-out fee — about 4 BTC — to the federation.

The on-chain argument

The movers left an OP_RETURN: “we are whitehats. contact us on chain.” Blockstream answered with a security address. The rest of the negotiation ran in PGP-signed OP_RETURNs and encrypted payloads inside bitcoin transactions. The condition was technical: patch the bug, patch every node, then the coins come back. Adam Back’s shop posted a signed message that the bridge nodes were patched and it was safe to return funds. The signature matched the key on Blockstream’s site.

On September 7, bitcoin block 965,950, 3,400 BTC — about $268–$270 million — landed back at the federation address. About 598.5 BTC, near $47 million, stayed in the attacker wallet. That is 85% returned and 15% kept. Blockstream says talks for the rest continue. The network is still paused while functionaries fix a chain split and harden the restart.

Call the retained stack what it is. Nobody published a bounty program that paid $47 million for this class of bug. The actors named themselves white-hats after they had the coins. Ledger’s Charles Guillemet and others have already rejected the costume. A negotiated return after a drain is better than a mixer. It is not the same as a disclosed vulnerability and a check. Prosecutors can still decide the costume does not matter.

What the federated model just learned

Liquid is a federation: a committee holds the bitcoin, L-BTC is the IOU, peg-out is the redemption window. Confidential transactions hide amounts. That privacy is the product. It is also why a range-proof cache bug can mint value nobody can see until the reserve is empty. Checking the peg yourself, after the fact, was ugly: 197 BTC against more than 4,200 L-BTC issued. The 1:1 story is a software story. When the software lies, the federation signs real coins out the door.

Sidechains and wrapped bitcoin live on that assumption. So do every other multisig bridge that treats an internal token as a claim on a cold wallet. Keys can be perfect and the claim can still be counterfeit. That is the lesson that survives the 3,400 BTC coming home.

Restart will decide whether Liquid is a paused product or a dead one. The remaining 598.5 BTC will decide whether this is remembered as a patched incident or as a $47 million unpaid invoice the network never agreed to. Until nodes are clean, the chain is consistent, and the peg is whole again, L-BTC is a ticker with an asterisk. Bitcoin on the base chain did not notice. The federated wrapper did.