The only primary-source fact currently verifiable about the alleged Liquid Network loss is that Blockstream, Liquid's technical provider, published an official phishing alert dated September
The only primary-source fact currently verifiable about the alleged Liquid Network loss is that Blockstream, Liquid's technical provider, published an official phishing alert dated September 9, 2026, acknowledging a recent incident on the Bitcoin sidechain while warning users about impersonators; the widely circulated figures on the size, duration, and disposition of any loss remain unconfirmed.
The headline claims driving attention to this story, that Liquid Network lost roughly $320 million in 23 minutes and that an attacker kept a portion of it, cannot be substantiated from any primary or verified secondary source available at press time. What can be confirmed is narrower, and that gap is the story. For related coverage, see Bitget Trustpilot Reviews 2026: 20 One-Star Claim Unverified.
Blockstream, which identifies itself as Liquid's technical provider, published a Liquid-related phishing alert dated September 9, 2026, per its official blog notice. That alert explicitly acknowledges a recent Liquid Network incident. For related coverage, see Is Kraken Safe in 2026? Security and Review Evidence Gaps.
The alert does not specify the incident's date, loss amount, technical cause, or transaction history. Blockstream also notes that identifying itself as the technical provider does not establish liability for any exploit, a distinction the alert draws directly.
No independent, readable reporting confirming a specific September 6 exploit could be obtained during research; publisher search pages returned HTTP 403, 429, and bot-challenge responses, leaving the minimum primary-plus-secondary proof set unmet. The named entity is Liquid Network, a Bitcoin sidechain; whether the event was a network-level failure versus an application, wallet, or custodian issue is not established by the primary source.
According to unconfirmed reports circulating on social media, the incident involved roughly $320 million, or 3,996 BTC. That figure appears only in a Reddit thread that could not be accessed during research, and no fetched source supplies the loss total, BTC count, valuation timestamp, or transaction identifiers.
The reported accounting is internally inconsistent: the same unconfirmed source describes 3,400 BTC returned and 598 BTC retained, which sums to 3,998 BTC, exceeding the claimed 3,996 BTC total by two coins. Coincu's earlier coverage of the reported return of 3,400 BTC with roughly 600 BTC unreturned reflects the same unverified figures.
The "23 minutes" appears in the circulating headline without defined start and end events. No timestamped transaction records, incident logs, or primary post-mortem documenting a first and last drain transaction were obtained.
Verifying such a window would require on-chain records distinguishing transaction submission, confirmation, discovery, and containment times under a consistent time zone. None of that evidence exists in the current record, so the duration claim cannot be treated as established.
Unconfirmed accounts attribute the event to a bug in the Elements codebase exploited via SideSwap's PAK mechanism. No fetched post-mortem, named technical statement, patch identifier, or advisory establishes this attribution, and the primary alert classifies nothing as a hack, exploit, or operational failure.
The central accountability question, framed by claims that an attacker returned most coins and retained the rest, cannot be answered from verified evidence. No attack or return transaction hashes, and no identified sender or receiver addresses, were provided or discovered.
Unconfirmed reports value the retained portion, about 598 BTC, at roughly $47 million, and Coincu has separately covered claims of the retention of about 598.5 BTC. A receiving address is not a verified person, and possession of funds is not legal entitlement; no identity, intent, bounty agreement, or authorization to retain funds has been verified.
Notably, Blockstream's alert specifically flags supposed white-hat or bounty contacts as impersonation lures, alongside fake L-BTC claim, refund, and re-peg sites and recovery-address requests. That documented warning cuts directly against any unverified narrative that a "white-hat" was cleanly entitled to keep coins. Broader claims of the full $320 million loss and $47 million retention remain single-sourced.
Blockstream reports that impersonators are posing as Liquid, Blockstream, and support staff through email, copied websites, and direct messages following the incident. The alert states the incident does not require users to move funds, enter a recovery phrase, check a reimbursement, re-peg assets, or install software sent by email.
Blockstream will never ask for your recovery phrase or PIN, or ask you to send funds anywhere. — Blockstream
Whether any users were reimbursed is unverified; the alert warns of fake reimbursement messages rather than confirming a repayment ledger. The notice also does not establish current operational safety, restart status, or a completed patch, so claims that the network is suspended, patched, and fully restored cannot be confirmed.
For market context unrelated to the alleged loss, Bitcoin traded at $77,182 in a CoinGecko research snapshot dated September 10, 2026 (UTC), down about 1.2% on the day; this is not an incident-time valuation and does not corroborate any dollar figure attributed to the event.
Bitcoin spot price · USD
Bitcoin traded at $77,182 in the supplied CoinGecko research snapshot dated September 10, 2026 (UTC). The exact observation time is unavailable. This is market context, not an incident-time valuation or evidence of the alleged Liquid losses. The linked public page updates over time.The next concrete trigger is a dated, official Liquid post-mortem from Blockstream specifying the incident's timing, loss accounting, and root cause, none of which the September 9 alert provided. Until identified withdrawal and return transactions, a reserve baseline, and any Elements or SideSwap advisory are published, the $320 million, 23-minute, and white-hat retention claims should be read as unverified.
Did Liquid Network actually lose funds? Blockstream's September 9 alert acknowledges a recent incident, but the specific loss account is unverified.
How much was allegedly lost? Not confirmed. The circulating 3,996 BTC total conflicts with the reported 3,400 BTC returned plus 598 BTC retained, which sum to 3,998 BTC.
Did the incident last exactly 23 minutes? No timestamped records defining a start and end were obtained; the duration is unverified.
Who received or retained the funds? No attacker identity, addresses, transaction hashes, or authorization to retain funds has been verified.
Were users affected or reimbursed? No verified reimbursement ledger exists; Blockstream warns of fake reimbursement messages and says users need not move funds or follow unsolicited recovery instructions.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The post Liquid Network Loss Claim: 23 Minutes and Who Kept the Funds was initially published on Coincu.
