The confirmed core comes straight from Blockstream. Its initial incident report, displayed as September 7 at 12:14 AM, says purported white-hat hackers withdrew approximately 4,000 BTC, then valued by the company at roughly $320 million, from the Liquid Federation wallet. For related coverage, see ChangeNOW API 2026: What It Offers, Who Uses It, and Whether It Delivers.
Approximate BTC withdrawn from the Liquid Federation wallet
~4,000 BTC
What the incident report actually confirms
Blockstream was specific about the mechanism. The withdrawals used the SideSwap Peg-out Authorization Key, or PAK, and the company says neither that key nor any others were compromised.
That distinction matters. The official record does not describe a break in Liquid’s underlying cryptography, and readers should not infer one. The reported nearly 4,000 BTC left the network through what Blockstream frames around a valid peg-out authorization, a framing echoed in coverage of how nearly 4,000 BTC left Liquid through a valid peg-out.
The blast radius was contained to Bitcoin. Blockstream’s initial report says other Liquid assets, including USDT, DePix and real-world assets, were unaffected by the security incident.
Exchanges moved fast. The initial report says they had been notified and had paused, or would pause, LBTC deposits and withdrawals, a lockdown that lines up with reporting that the Liquid Network was halted after the alleged BTC withdrawal.
By September 9, the fallout had spawned impersonators. Blockstream’s phishing alert says scammers were posing as Liquid, Blockstream and support staff, and stresses the incident did not require users to move funds, enter recovery phrases, re-peg assets or install software sent by email.
The 85% recovery claim rests on one outlet
Here is where the evidence gets thinner. The headline’s claim that Blockstream recovered 85% of the stolen BTC, roughly 3,400 BTC leaving about 598.5 BTC outstanding, comes from Crypto Briefing, according to unconfirmed reports, and was not confirmed by any official Blockstream statement obtained in reporting.
Treat that 85% as a media figure, not a settled fact. The rounded 4,000 and 3,400 numbers do not independently produce the precise remainder, and no on-chain transactions, addresses or recovered totals were verified. A separate account framed the return differently, describing how Liquid hackers returned $270M in Bitcoin after the theft.
Recovery is also not the same as restitution. The remaining balance, described in unconfirmed reports as worth roughly $47 million, has an unknown location and status, and nothing in the official record establishes that users have been made whole or that access is fully restored.
Peg-outs are still frozen, and the ransom refusal is unverified
Blockstream’s most recent official update is dated September 10, 2026, 10:00 UTC. It says block production resumed without transactions while the network was monitored to confirm stabilization.
“As a precautionary measure, block production has resumed without transactions while the network is monitored to confirm full stabilization.” — Blockstream, September 10 update
That same update says required functionary and bridge node updates had been deployed, and functionary nodes were signing and validating blocks as intended.
But the system is not back to normal. As of the September 10 update, peg operations, including PAK-authorized peg-outs, remained suspended and BTC/LBTC reserve restoration was still in progress. No newer official resumption statement was obtained, so this is the September 10 status, not a confirmed September 11 all-clear.
The ransom refusal itself sits entirely on secondary reporting. According to unconfirmed reports from Crypto Briefing, Blockstream announced on September 11 that it would not pay the attackers, with related accounts noting that recovery talks over the outstanding balance continued. No authenticated company statement, on-chain message or named law-enforcement agency was independently confirmed.
So the sequence in the headline, recovery followed by refusal, remains a reported one, not a documented one. The ransom terms, the fate of the outstanding BTC, and whether Liquid’s peg-outs reopen on schedule are all still open. Which will crystallize first, an official recovery tally or the next chapter of the standoff?
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
