Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin's public record shows. About 598.5 bitcoin has not come back. Liquid is a Bitcoin sidechain that holds real bitcoin to back a token called L-BTC. The network is still paused, so holders cannot turn that token back into bitcoin. The 3,400 bitcoin was sent to a&
- 1. Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin's public record shows.
- 2. Liquid is a Bitcoin sidechain that holds real bitcoin to back a token called L-BTC.
- 3. The bitcoin was sent via SideSwap's Peg-out Authorization Key, one of the keys that release funds from the sidechain.
Article analysis
Skim this article about "Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC": 3 key takeaways and more.
Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
skim AI Analysis | The Hacker News
The Hacker News on Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC: skim's analysis surfaces 3 key takeaways. Liquid Network hackers returned 3,400 of the 4,000 Bitcoin stolen via an Elements bug. Read the takeaways in seconds, then decide whether the full article is worth your time.
Category: Business. News article analyzed by skim.
Summary
Liquid Network hackers returned 3,400 of the 4,000 Bitcoin stolen via an Elements bug. Approximately 598.5 Bitcoin remain unreturned. The network is paused, and the incident involved a bug in Elements software, not compromised keys.
Key Takeaways
- Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin's public record shows.
- Liquid is a Bitcoin sidechain that holds real bitcoin to back a token called L-BTC.
- The bitcoin was sent via SideSwap's Peg-out Authorization Key, one of the keys that release funds from the sidechain.
Statement Breakdown
- Claimed Facts: 60% of statements the article presents as facts
- Opinions: 30% of statements classified as editorial or subjective
- Claims: 10% of statements surfaced for additional reader evaluation
Credibility & Bias Reasoning
Credibility assessment: The article presents factual information about a cryptocurrency hack and recovery, citing transaction details and official statements. However, it relies on secondary reporting and includes speculative elements regarding the hackers' motives and the nature of the agreement.
Bias assessment: Crypto-Enthusiast Reporting. The article frames the event through the lens of cryptocurrency operations, using technical jargon and focusing on the mechanics of the hack and recovery. It leans towards explaining the situation for those familiar with the crypto space.
Note: This article details a complex cryptocurrency event. While factual reporting is present, some claims about hacker motives and agreements are speculative and should be viewed with caution.
Credibility flag: Technical, Speculative
Claimed Facts (10)
- This is a specific, quantifiable statement about the remaining stolen funds.
- This provides a precise detail about the return transaction, including the amount, recipient, and timing.
- This clarifies the nature of the unreturned Bitcoin, explaining it as change from the return transaction.
- This reports a statement from Blockstream regarding the incident and the amount taken.
- This provides a statistic about the scale of the withdrawal relative to Liquid's reserves, citing another source.
- This presents a calculation of the value of the returned and unreturned Bitcoin based on a specific price.
- This explains the technical process of a 'peg-out' transaction, which is relevant to the hack.
- This attributes the cause of the hack to a bug in the Elements software, citing a source.
- This reports on the actions taken by Blockstream to address the security issue.
- This provides an expert's estimate of the unreturned amount, identifying the source.
Opinions (7)
- While presented as a fact, the term 'federation' can be interpreted in various ways, and this statement defines it within the context of the article's narrative.
- This statement highlights a lack of official confirmation, implying a degree of uncertainty or speculation.
- This describes the hackers' demands, which are presented as a narrative of negotiation rather than a confirmed fact of the agreement.
- This reports on Blockstream's response, which is framed as part of a dialogue and negotiation.
- This statement from Samson Mow suggests ongoing communication, which is an interpretation of the situation.
- This is advice given by an individual, reflecting a recommended course of action based on the current situation.
- This statement from Blockstream provides reassurance about other assets, which is a form of communication aimed at managing perception.
Claims (5)
- This claim about the hackers' demands is presented as a condition for returning funds, which could be interpreted as a negotiation tactic rather than a pure 'white hat' action.
- This introduces doubt about the hackers' self-proclaimed 'white hat' status without providing specific counter-evidence, relying on an unnamed consensus.
- This presents a strong opinion that directly contradicts the 'white hat' narrative, framing the situation as potentially extortionate.
- This is a highly speculative interpretation of the unreturned Bitcoin, framing it as a potential ransom rather than a reward for finding a bug.
- While technically true that messages were sent on the blockchain, the framing of this as 'talking' can be seen as anthropomorphizing the transaction data.
Key Sources
- The Hacker News — Media
- Blockstream — Technology Provider for Liquid
- Liquid Network — Bitcoin Sidechain
- The Block — Media
- SideSwap — Platform
- Unchained — Media
- Samson Mow — Chief Executive of JAN3, former Blockstream executive
- Charles Guillemet — Chief Technology Officer at Ledger
This analysis was generated by skim (skim.plus), an AI-powered content analysis platform by Credible AI. Scores and classifications represent the platform's AI-generated assessment and should be considered alongside other sources.
skim analyzes recent The Hacker News coverage for what holds up, what reads as opinion, and what may not be fully supported. Last updated 8th September 2026.