Iranian ballistic missile strikes overnight Wednesday, targeted the Muwaffaq Salti Air Base in Jordan, reportedly damaging multiple US military aircraft** stationed there. An A-10 Thunderbolt (Warthog) suffered a direct hit that resulted in a missing wing, while about eight F-15 fighter jets sustained light damage. The damaged F-15s were subsequently repaired and returned to service, with no US fatalities reported at the base.

US forces in Jordan launched more than 30 Patriot missiles to intercept the Iranian attack, which occurred following weeks of relative calm in the escalating US-Iran conflict.

The strikes on Muwaffaq Salti Air Base were reportedly launched by Iran's Islamic Revolutionary Guard Corps (IRGC) and came directly in response to a major U.S. naval action where American forces targeted and sank five Iranian oil tankers following Iran's attempts to strike U.S. naval assets and commercial shipping. The IRGC launched coordinated missile attacks targeting key regional hubs housing American forces, including installations in Jordan, Kuwait, and Bahrain.

U.S. Central Command (CENTCOM) on Tuesday, destroyed five Iranian crude oil tankers in retaliation for repeated ballistic missile attacks by the Islamic Revolutionary Guard Corps (IRGC) on a U.S. Navy warship in the last few days. Four tankers were hit in the Gulf of Oman and one near Kharg Island, Iran’s primary oil export hub; these vessels had moved 45 million barrels of Iranian oil since 2019.

The strikes were part of a new “tanker for tanker” policy approved by President Trump, escalating a broader campaign to cripple Iran’s economy after earlier U.S. strikes on three tankers on September 5 following IRGC attacks on U.S. destroyers DDG-119 and DDG-53.

In retaliation to Tuesday's attacks, the IRGC launched a ballistic missile barrage at U.S.-linked bases in Jordan, specifically targeting the Al-Azraq air base (housing F-35, F-16, and F-15 fighter jet facilities) and the Muwaffaq Salti and Prince Hassan military bases. Jordan’s air defenses intercepted 18 of the 20 missiles launched, with the two remaining landing away from population centers.

The IRGC also claimed it attacked U.S. Navy destroyers and warned of strikes on tankers in Kuwait and Bahrain.

Meanwhile, Iran claimed to have seized a U.S. underwater drone near the Strait of Hormuz. State media identified the craft as the Dive-LD, a 19-foot autonomous submarine manufactured by U.S. defense firm Anduril Industries. This occurred amid ongoing U.S. naval operations to escort commercial shipping through the strait, where ~40 ships transited daily carrying millions of barrels of oil.

The ongoing conflict has transformed the Persian Gulf into a high-intensity maritime battleground involving commercial shipping disruptions, drone warfare, and subsea mining attempts. The war began on February 28, 2026, when pre-emptive U.S. and Israeli military strikes hit Iranian nuclear facilities, leadership command centers, and strategic targets.

Liquid Network has recovered 3,400 BTC (about $268 million) after an exploit drained nearly 4,000 BTC (about $320 million) from its federation wallet. The attacker, who identified as a "white hat," retained 598.5 BTC (about $47 million) in an address linked to the withdrawal, representing roughly 15% of the stolen funds.

The incident stemmed from a range-proof verification cache bug in Elements, the open-source software powering Liquid nodes, which allowed the creation of unbacked L-BTC tokens. No private keys or federation wallets were compromised; instead, attackers exploited the issuance logic to generate valid-looking tokens that were then pegged out via SideSwap, draining 95% of Liquid’s Bitcoin reserves.

Liquid immediately froze network operations and disabled bridge nodes to secure the remaining assets. The network remained paused while node operators updated their bridge software and verified the security fixes.

Communication between the attacker and Blockstream occurred entirely on-chain via Bitcoin OP_RETURN messages.

The hacker consolidated the stolen Bitcoin into a single address and broadcasted an OP_RETURN message reading: "we are whitehats. contact us on chain."

Blockstream established formal contact around Bitcoin block 965,822 by embedding encrypted text and a PGP signature in an OP_RETURN transaction.

The attacker sent encrypted details of the exploit back to Blockstream, stating they would not return the funds until the bug was fully patched across all network nodes.

Blockstream replied with a PGP-signed OP_RETURN message confirming against their official key on record: "Bridge nodes are patched, safe to return the funds," after which the attacker broadcast the return transaction.

While the return mitigated immediate insolvency risks, Liquid Network operations remain paused to restore 1:1 backing, and the status of the retained $47 million remains unclear, with no formal bounty agreement published.

Liquid official communications referred to the actor as a "purported white-hat hacker." Security experts and crypto community members heavily debated labeling the hacker a true "white hat," noting that taking funds by force prior to negotiations is extortion rather than responsible disclosure.