Two notable crypto security incidents dominated headlines on Sept. 7, 2026, highlighting risks in decentralized trading platforms and Bitcoin sidechains. Rocket suspended deposits, withdrawals and trading after an attacker manipulated a dormant perpetual market and withdrew roughly $287,000 in positive PnL from the platform’s Bridge. Meanwhile, Blockstream’s Liquid Network saw purported white-hat hackers offer to return most of the nearly 4,000 Bitcoin withdrawn in a $320 million security incident.
Rocket incident: According to Rocket’s Sept. 7 update on X, the attack occurred around 19:00 UTC on Sept. 5. The attacker used a burner account to place orders at artificially inflated prices and traded against themselves in an inactive perpetual market. This created fake profits in one account while the burner account became insolvent. The profitable account withdrew about $287,000 through the Bridge, leaving the resulting loss to be socialized across the platform. Blockchain security tracker SlowMist classified the incident as a price manipulation attack and recorded the loss at $287,000. Rocket said it is working with security firms, law enforcement agencies, exchanges, bridges and stablecoin issuers to trace and freeze funds. The team is preparing a recovery plan that will prioritize refunds for smaller affected accounts, though no timeline or recovery fund size has been disclosed.
Rocket also warned users to watch for impersonators and said recovery information will be published only through its official X account and Discord channels. The method resembles previous thin perpetual market incidents, including Hyperliquid’s JELLY market manipulation in March 2025 and Notional Finance’s suspected $1.7 million exploit.
Liquid Network incident: Galaxy Research head Alex Thorn reported that the purported white-hat hackers behind the $320 million Liquid Network incident offered to return most of the withdrawn Bitcoin. The actors communicated with Blockstream using Bitcoin OP_RETURN transactions and encrypted PGP messages. Nearly 4,000 BTC, about 95% of Bitcoin pegged into the sidechain, was removed from the Liquid Federation wallet. Liquid disabled its bridge nodes and paused network operations while Blockstream investigates the vulnerability.
According to Thorn, Blockstream initiated contact at block 965,822 with 1,000 satoshis and an OP_RETURN message. The hackers responded at block 965,869 and asked whether returning most of the Bitcoin would be acceptable, but demanded that Blockstream fix the underlying vulnerability network-wide first: “Please fix the bug first.” Ledger CTO Charles Guillemet initially questioned whether legitimate security researchers would remove hundreds of millions from a bridge but later said the on-chain communication offers some reason for optimism.
The incidents remain unresolved: Rocket has not confirmed any frozen funds, and Liquid’s recovery depends on hackers honoring an agreement with no enforceable guarantee.
