Liquid Is About 86% Backed. Who Counted.
The gross theft was $320 million. The net, as of today, is $47 million. The backing ratio is about 86%. Each of those numbers was produced by someone paid to produce it, and that payroll is the subject of this post.
TLDR
- 86%. Roughly 3,597 BTC in Liquid's identified reserve address against an estimated 4,200 L-BTC outstanding, per TRM Labs, after the partial return. Not a full reserve.
- $47 million. About 598.5 BTC that the attackers kept after sending 3,400 BTC back on September 7. Blockstream has not said whether that is a bounty.
- 1 day. How long it took TRM to label the attackers' addresses. That number is why blockchain forensics jobs exist.
Eighty-six percent. That is the backing ratio of L-BTC after the largest crypto theft of 2026 was mostly reversed, and it comes from TRM's count of about 3,597 BTC in the identified reserve against an estimated 4,200 L-BTC outstanding. TRM notes it is not a full reconciliation. It is the best public number, and it is the one a compliance desk uses.
We will use the Liquid incident to describe a labor market that gets hired the moment something like this happens. Every figure below is public and every figure was produced by someone paid to produce it. Readers weighing that side of the industry can browse web3 jobs with the numbers in hand.
1. The gross number and the net number are $273 million apart
On September 6, about 4,000 BTC, roughly $320 million at the time, left Liquid's federation wallet in a single peg-out. Blockstream's notice attributed it to "purported white-hat hackers" and said the peg-out authorization key was not compromised. The mechanism, per TRM and Halborn, was a bug in Elements, the sidechain's validation software, that allowed unbacked L-BTC to be minted and redeemed.
On September 7 at 16:09 UTC, 3,400 BTC went back to a Liquid Federation address. At a bitcoin price of about $78,000 on September 8, that was roughly $265 million returned. The 598.5 BTC that stayed out was worth about $47 million.
So the gross theft was $320 million and the net theft, as of today, is $47 million. Both are true. Only one belongs in a reserve calculation.
2. The number everyone quotes and the number that holds up
| The number everyone quotes | The number that holds up |
|---|---|
| "$320 million stolen from Liquid." | $320 million withdrawn; 85% returned within 24 hours; about $47 million net outstanding as of September 8, per TRM and The Hacker News. |
| "White hats returned the money." | 3,400 of roughly 4,000 BTC came back. The actors called themselves white hats. TRM calls the claim unverified. 598.5 BTC did not come back. |
| "L-BTC is backed one to one." | About 3,597 BTC in the identified reserve against about 4,200 L-BTC outstanding, roughly 86%, per TRM, which also says this is not a full reconciliation. |
| "The biggest hack of 2026." | The largest gross withdrawal of 2026, ahead of the April KelpDAO thefts, per TRM. On a net basis the ranking depends on what the $47 million turns out to be. |
| "Bitcoin was hacked." | Bitcoin's main chain and protocol were unaffected. The flaw was in Elements, the sidechain software. The stolen coins are real bitcoin that left a sidechain reserve. |
The right-hand column was assembled by people at TRM, Chainalysis and Blockstream within 72 hours. The left-hand column was assembled by the timeline in about 72 minutes. The gap between the columns is the job.
3. One incident, four payrolls
An exploit of this size activates four functions at once, and each is a team with a pay band. The bands below are from CryptoJob's own guides, which are drawn from reported offers and postings.
| Function | What September 6 to 9 asked of it | Base range, US and remote |
|---|---|---|
| Blockchain forensics investigator | Label the attacker addresses, trace the 598.5 BTC, distinguish the returned flow from the retained flow | $70K to $105K entry, $150K to $200K senior, per the data analyst guide |
| Exchange compliance analyst | Consume the labels, screen inbound flows, decide what to freeze | $60K to $95K entry, $120K to $170K senior, per the compliance guide |
| On-chain research analyst | Publish the reconciliation, the backing ratio, the peg status | $90K to $180K, per the SIREN on-chain analyst guide |
| Reserve and risk analyst at a federation member | Recompute exposure, decide whether to keep L-BTC listed | $110K to $180K, per the same guides |
Ranges vary by employer. TRM and Chainalysis pay on the investigator scale with equity. The exchange desks pay base plus bonus. The federation members, which are custodians and exchanges, pay on their own internal bands.
4. The labels came in a day. The reconciliation came in three.
TRM labeled the attackers' addresses within a day of the withdrawal and continues to track the roughly $47 million that was never returned. Chainalysis published its breakdown on September 9. Halborn's explanation of the Elements bug followed. Blockstream's own notices gave the 4,000 BTC figure, the peg-out key detail and the incident timeline.
That sequence is the shape of a forensics career. Day one is attribution: which addresses, which clusters, which exchanges they touch. Day two is flow: what came back, what didn't, where the remainder sits. Day three is reconciliation: how much is in the reserve, how much is outstanding, what the ratio is. Each step is a different skill, and the firms that do this hire for each separately.
The reconciliation is the hard part and the one with the fewest people. TRM's 86% figure required identifying the reserve address, counting the L-BTC supply and stating the uncertainty. Anyone can quote $320 million. Fewer people can defend 3,597 against 4,200.
5. Why the $47 million matters more than the $320 million
If the 598.5 BTC is a negotiated bounty, Liquid's federation absorbed a $47 million cost and L-BTC holders are, in principle, made whole once the network resumes. If it is retained loot, the peg is short by that amount and someone bears it. Blockstream has not said which.
For hiring, the distinction is the work itself. The forensics firms are tracing where the 598.5 BTC goes. The compliance desks are deciding whether to accept L-BTC deposits when trading resumes. The federation members are deciding whether the model survives. None of that is done by the people who wrote the headlines.
6. What the data doesn't say
- It does not say the attackers are white hats. They said so. TRM calls the claim unverified. Returning 85% is consistent with a white hat and with a negotiator.
- It does not say the 598.5 BTC is a bounty. No party has stated the terms, if there are terms.
- It does not say L-BTC holders will be made whole. The network is paused. The backing ratio is a snapshot, not a settlement.
- It does not say when trading resumes. As of September 8, exchanges had not resumed L-BTC trading, and we have no later public date.
- It does not say the forensics firms are hiring this week. It says the work exists and was done. Postings follow work with a lag we cannot measure from outside.
Method and sources
The withdrawal figure, the return figure and the reserve ratio are from TRM Labs' September 8 report and The Hacker News' September 8 account of the on-chain record, which states the 3,400 BTC return at 16:09 UTC on September 7 and the 598.5 BTC remainder. Dollar values use the roughly $78,000 bitcoin price those sources cite for September 8; the $320 million headline figure uses the price on September 6. The mechanism description is from TRM, Halborn and Blockstream's incident notice. The Chainalysis date is from its own September 9 publication. The KelpDAO comparison is TRM's. Salary bands are CryptoJob's published guides, linked in the table; they reflect reported offers and postings as of their publication dates and are not a survey of TRM, Chainalysis or the federation members. We excluded every figure that came only from social media, including several higher estimates of the unreturned amount. Readers can browse web3 jobs to see current forensics and compliance postings directly.
Two questions I get asked
1. What does a blockchain forensics job actually involve day to day?
Attribution, flow tracing and reconciliation, in roughly that order of frequency. Most days are attribution: clustering addresses, labeling exchanges and services, maintaining the dataset that makes the day-one label possible. Incident weeks are flow tracing. Reconciliation, the 86% kind, is rare and done by senior people, and it is the part that gets cited by name.
2. Do I need to know how Elements or Bitcoin Core works to get hired?
For the investigator roles, no; the tooling abstracts the chain and the job is data work. For the reconciliation and reserve-risk roles, yes, because counting L-BTC outstanding means understanding how the sidechain issues and burns it. The compliance desk roles sit between: you need to read a TRM label correctly and know what a peg-out is.
