About 4,000 BTC flowed out of the Liquid Network, the federated sidechain operated by Adam Back's Blockstream, in early September, and the have still not returned roughly 600 BTC — a sum worth around USD 47 million. The exploit has coincided with further turbulence around Back's ventures: a USD 4 billion bitcoin treasury deal from his circle has fallen through, and Bloomberg reports that several firms are suing the mining company Exacore. There is no proof of a causal link between the hack, the failed deal and the lawsuits.

Back is a cryptographer whose Hashcash scheme is cited in the Bitcoin white paper, and he is accordingly counted among the pioneers and early enthusiasts of Bitcoin. In 2014, he founded Blockstream, which builds infrastructure for Bitcoin, including the Liquid Network. The sidechain settles bitcoin as L-BTC, with tokens backed by BTC that users first deposit into a wallet of the so-called Federation. According to Bloomberg, Blockstream raised USD 210 million after the 2024 Bitcoin conference in Nashville. In April 2025, there was also talk of more than USD 350 million for the mining unit — though Blockstream had spun off its mining business about two years earlier.

Unbacked L-BTC: how the exploit drained 4,000 BTC

The attack exploited a flaw in Elements, the software on which Liquid runs. The bug affected a cache that checks range proofs — the cryptographic checks that keep transaction amounts confidential on Liquid while still letting the network verify that they are valid. First, the attackers used this gap to create L-BTC with no bitcoin behind them. They then used the Peg-out Authorization Key (PAK) of the Liquid service SideSwap, which let them swap the unbacked tokens for real BTC withdrawals from the Federation wallet. The exploit chain thus combined the two safeguards that hold the federated model together — the software validating transactions and the keys authorizing withdrawals — which is why a single flaw could reach the very reserve that backs all L-BTC.

In total, about 4,000 BTC worth roughly USD 320 million left the wallet this way. Before the attack it held about 4,200 BTC; afterwards, only 197 BTC. The Federation holds this reserve, which comes from user deposits. As a result, the circulating L-BTC temporarily lacked most of its backing.

Self-declared white hats return most of the funds

The attackers presented themselves as white hats, meaning security researchers who report flaws instead of exploiting them. Later, they sent back about 3,400 BTC. Yet they kept about 598 BTC, worth roughly USD 47 million, as a reward they set for themselves. In an on-chain message, the attacker demanded a 10% bounty.

Samson Mow, Blockstream's former chief strategy officer, confirmed the outstanding amount. He also said Blockstream remained in contact with the white-hat hackers. Blockstream's own tally, by contrast, puts the figure at about 602 BTC. Analytics firm TRM Labs ranks the incident, at about USD 319 million, as the largest hack of 2026 so far; according to the analysts, 85% of the funds flowed back.

A few days after the attack, a patch for Elements closed the flaw, and the network later resumed block production. Blockstream ultimately rejected the bounty demand: "We will not pay for the return of stolen property. We will not abandon our users." The company calls the incident theft. Taking assets without permission and withholding their return is "a crime, not responsible disclosure," it said — conduct that, in its view, has nothing to do with white-hat work. How to deal with attackers who demand payment is a recurring dilemma after major crypto exploits; Blockstream's answer here was an unambiguous refusal.

As early as September 10, Back gave assurances that the 1:1 peg of L-BTC to bitcoin would stay backed. However, according to a Liquid notice from late September, peg-outs — the withdrawals from Liquid back to Bitcoin blockchain — remain suspended. The roughly 602 outstanding BTC therefore still count as unrecovered. For L-BTC holders, the suspension is the practical constraint, since without peg-outs bitcoin held on Liquid cannot be withdrawn to the main chain; a follow-up notice lifting the suspension, and any movement of the outstanding coins, are the visible markers to watch.

BSTR and Cantor call off the USD 4 billion deal

Back is also CEO and co-founder of Bitcoin Standard Treasury Company (BSTR), a bitcoin treasury vehicle — a company whose balance sheet consists mainly of bitcoin. In July 2025, BSTR signed a merger agreement with Nasdaq-listed Cantor Equity Partners I (CEPO), a special purpose acquisition company (SPAC) — a listed shell firm that takes a private company public through a merger. Under the original terms, the vehicle was to contribute 30,021 BTC, worth more than USD 3 billion, through the combination, while another USD 1.5 billion was to come from a PIPE, a private capital raise from selected investors. Altogether, the deal implied a valuation of about USD 4 billion. The votes on the transaction, however, slipped several times.

In August 2026, just over a year after signing, BSTR and CEPO terminated the agreement. BSTR's press release (SEC filing) describes the termination as mutual and cites weak valuations of listed bitcoin treasury vehicles and disrupted capital markets as the reason. Bloomberg, on the other hand, attributes the termination to Cantor. The matter is not closed: according to Cantor, BSTR owes a USD 15 million termination fee. For now, all that remains of the planned billion-dollar deal is a claim worth millions.

Exacore: power bills and supplier lawsuits in the mining business

Exacore operates in bitcoin mining, where computing facilities produce new blocks and consume large amounts of power in the process. According to Bloomberg, Blockstream's spun-off mining business worked with Exacore as a partner. Exacore's chief, per the report, is Chris Cook, a longtime confidant of Back. A court sentenced Cook to 41 months in prison for mail fraud in 2008, Bloomberg reports, and a lawsuit against him in connection with a Boeing 767 is pending in Florida.

Utility Xcel Energy has sued Exacore over unpaid power bills, with about USD 1.1 million outstanding, according to Bloomberg. Giga Energy filed suit in February because Exacore allegedly breached a purchase agreement for mining equipment; Exacore denies this, Bloomberg writes. Furthermore, BLS Electrical is seeking just under USD 1 million for unpaid work and equipment.

The details of the cases come from the Bloomberg report, and the amounts reflect the plaintiffs' view. The claims from Xcel and BLS alone add up to about USD 2 million, making the power bill the largest item among the claims Bloomberg quantifies. The mix of claims — electricity, mining hardware, electrical work — mirrors the cost structure of a business built around power and specialized equipment. None of the suits has been decided yet; as filed, the amounts remain claims rather than court findings.

Blockstream distances itself from the mining partner

Blockstream draws a line between itself and Exacore. A spokesperson said the company has no operational involvement in Exacore whatsoever and no connection to the firm. Likewise, President Michael Minkevich distances himself from mining, which he describes as capital-intensive and a poor fit for Blockstream.

Nevertheless, Bloomberg reports a link to mining that runs through Back himself. A 2025 document names him as a director of BM OpCo, the borrower under Blockstream Mining Note 2 (BMN2). According to Blockstream, Back holds no equity there. Issued in Luxembourg in 2024, the note runs through SICOS Securities, with STOKR handling its tokenization. In October 2025, its capacity rose from USD 200 million to USD 2 billion. Back did not respond to Bloomberg's requests.

Where things stand

About 600 BTC from the Liquid exploit remain outstanding, and Blockstream refuses to pay a bounty for their return. Bloomberg says lawsuits with quantified claims totaling about USD 2 million are pending against Exacore. By Cantor's account, BSTR also owes Cantor USD 15 million. From here, the concrete markers to watch are the return of the outstanding coins, a Liquid notice lifting the peg-out suspension, the resolution of the USD 15 million fee claim and the outcomes of the Exacore suits.

Source: Crypto Valley Journal, based on reporting by Bloomberg.