About 4,000 BTC flowed out of the Liquid Network of Adam Back's Blockstream in early September, and the attackers have still not returned about 600 BTC. In addition, a USD 4 billion treasury deal from Back's circle has fallen through, and Bloomberg reports that several firms are suing the mining company Exacore.
Adam Back is a cryptographer, and the Bitcoin white paper cites his Hashcash scheme. Hence he counts as a pioneer and an early Bitcoin enthusiast. In 2014, he founded Blockstream, which builds infrastructure for Bitcoin, including the Liquid Network. This federated sidechain settles bitcoin as L-BTC. The tokens are backed by BTC that users first deposit into a wallet of the so-called Federation. After the 2024 Bitcoin conference in Nashville, Blockstream raised USD 210 million, according to Bloomberg. In April 2025, there was also talk of more than USD 350 million for the mining unit. However, Blockstream spun off its mining business about two years ago. There is no proof of a causal link between the hack, the failed deal and the lawsuits.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
Liquid exploit: how unbacked L-BTC drained 4,000 BTC
The attack exploited a flaw in Elements, the software on which Liquid runs. The bug affected a cache that checks range proofs. First, the attackers used this gap to create L-BTC with no bitcoin behind them. They then used the Peg-out Authorization Key (PAK) of the Liquid service SideSwap. This let them swap the tokens for real BTC withdrawals from the Federation wallet. Overall, about 4,000 BTC worth roughly USD 320 million left the wallet this way. Before the attack it held about 4,200 BTC, afterwards only 197 BTC. The Federation holds this reserve, which comes from user deposits. As a result, the circulating L-BTC temporarily lacked most of their backing.
The attackers presented themselves as white hats, meaning security researchers who report flaws instead of exploiting them. Later, they sent back about 3,400 BTC. Yet they kept about 598 BTC, worth roughly USD 47 million, as a reward they set for themselves. In an on-chain message, the attacker demanded a 10% bounty. Samson Mow, Blockstream's former chief strategy officer, confirmed the outstanding amount. He also said Blockstream remained in contact with the white-hat hackers. Blockstream's own tally, by contrast, puts the figure at about 602 BTC. Analytics firm TRM Labs ranks the incident, at about USD 319 million, as the largest hack of 2026 so far. According to the analysts, 85% of the funds flowed back.
A few days after the attack, a patch for Elements closed the flaw, and the network later resumed block production. Finally, Blockstream rejected the bounty demand: "We will not pay for the return of stolen property. We will not abandon our users." The company calls it theft. Taking assets without permission and withholding their return is "a crime, not responsible disclosure," it said. In its view, this has nothing to do with white-hat work. As early as September 10, Back gave assurances that the 1:1 peg of L-BTC to bitcoin would stay backed. However, according to a Liquid notice from late September, peg-outs remain suspended. These are the withdrawals from Liquid back to the Bitcoin blockchain. The roughly 602 outstanding BTC thus still count as unrecovered.
BSTR and Cantor call off the USD 4 billion deal
Back is CEO and co-founder of Bitcoin Standard Treasury Company (BSTR). The firm takes the form of a bitcoin treasury vehicle, meaning a company whose balance sheet consists mainly of bitcoin. In July 2025, BSTR signed a merger agreement with Nasdaq-listed Cantor Equity Partners I (CEPO). Initially, the vehicle was to contribute 30,021 BTC worth more than USD 3 billion through the combination. Another USD 1.5 billion was to come from a PIPE, a private capital raise from selected investors. Altogether, this added up to a valuation of about USD 4 billion. Yet the votes on the deal slipped several times.
In August 2026, BSTR and CEPO terminated the agreement, just over a year after signing it. BSTR's press release describes the termination as mutual. It cites weak valuations of listed bitcoin treasury vehicles and disrupted capital markets as the reason. Bloomberg, on the other hand, attributes the termination to Cantor. Still, the matter is not closed. According to Cantor, BSTR owes a USD 15 million termination fee. For now, all that remains of the planned billion-dollar deal is therefore a claim worth millions.
Exacore: power bills and supplier lawsuits in the mining business
Exacore operates in bitcoin mining. Its computing facilities produce new blocks and consume a lot of power in the process. According to Bloomberg, Blockstream's spun-off mining business worked with Exacore as a partner. Exacore's chief, per the report, is Chris Cook, a longtime confidant of Back. A court sentenced Cook to 41 months in prison for mail fraud in 2008, Bloomberg reports. Moreover, a lawsuit against him in connection with a Boeing 767 is pending in Florida.
Utility Xcel Energy has sued Exacore over unpaid power bills, with about USD 1.1 million outstanding, according to Bloomberg. Giga Energy filed suit in February because Exacore allegedly breached a purchase agreement for mining equipment. Exacore denies this, Bloomberg writes. Furthermore, BLS Electrical is seeking just under USD 1 million for unpaid work and equipment.
The details of the cases come from the Bloomberg report, and the amounts reflect the plaintiffs' view. The claims from Xcel and BLS alone add up to about USD 2 million. Of the claims Bloomberg quantifies, the power bill is thus the largest item.
Adam Back's Blockstream distances itself from the mining partner
Blockstream draws a line between itself and Exacore. A spokesperson said the company has no operational involvement in Exacore whatsoever and no connection to the firm. Likewise, President Michael Minkevich distances himself from mining, which he describes as capital-intensive and a poor fit for Blockstream.
Nevertheless, Bloomberg reports a link to mining that runs through Back himself. A 2025 document names him as a director of BM OpCo, the report says. BM OpCo is the borrower under Blockstream Mining Note 2 (BMN2). According to Blockstream, Back holds no equity there. Issued in Luxembourg in 2024, the note runs through SICOS Securities, with STOKR handling its tokenization. In October 2025, its capacity rose from USD 200 million to USD 2 billion. Back did not respond to Bloomberg's requests.
About 600 BTC from the Liquid exploit remain outstanding, and Blockstream refuses to pay a bounty for their return. Bloomberg says lawsuits with quantified claims totaling about USD 2 million are pending against Exacore. By Cantor's account, BSTR also owes Cantor USD 15 million.
