Attackers drained $319 million in Bitcoin from the Liquid Network in what TRM Labs has identified as the largest crypto exploit of 2026 to date. The blockchain intelligence firm also confirmed that the attackers subsequently returned roughly 85% of the stolen funds — approximately $271 million based on the reported total.

The incident, first flagged by TRM Labs, centers on the Liquid Network, a Bitcoin sidechain operated by Blockstream that anchors to the Bitcoin main chain via a two-way peg. Liquid is widely used for asset issuance and faster settlement between exchanges and institutional traders, which makes the size of the breach significant well beyond the headline number.

How much of the money came back?

According to TRM Labs, the attackers returned 85% of the $319 million haul. That leaves roughly $48 million unaccounted for. Voluntary returns of this scale are rare in crypto exploitation, where stolen Bitcoin is typically dispersed through mixers, cross-chain bridges or over-the-counter channels to frustrate tracing.

TRM Labs did not specify in the initial report the mechanism of the return, the wallets involved, or the timeline over which the funds flowed back. The firm's on-chain analysis identified the theft as the single largest crypto hack recorded in 2026 so far.

Why Liquid's design matters here?

Liquid's security model depends on a federation of functionaries that manage the peg — the process by which Bitcoin locks on the main chain and corresponding assets mint on the sidechain. A breach of this scale raises structural questions about federation custody, key management and the operational safeguards that govern the two-way peg.

The exploit size also redraws the map for 2026. At $319 million, the incident exceeds any other reported crypto hack this year, according to TRM Labs' accounting, putting Liquid at the top of a loss ledger the industry would rather forget.

For exchanges and market makers that route liquidity through Liquid, the immediate operational consequence is reassessment: counterparty exposure, peg redemption queues and treasury allocation on sidechain infrastructure all warrant fresh scrutiny following a nine-figure drain.

What happens next?

TRM Labs' figures give investigators a concrete anchor: $319 million out, roughly $271 million back, and a residual gap that blockchain-analytics teams will now chase across addresses and clusters. Whether the returned funds flow back to affected parties, and whether the remaining balance is recovered or permanently lost, will define the final loss figure for the year's largest exploit.