Liquid Network, a Bitcoin-based settlement network used by cryptocurrency exchanges, halted new transactions after approximately $320 million worth of bitcoin was withdrawn from its federation wallet in a security exploit.

According to Liquid Network, around 4,000 of the 4,200 bitcoin held in the wallet were taken by individuals describing themselves as “white-hat hackers.”

The network, launched by Blockstream in 2018 and overseen by a federation of more than 80 exchanges, infrastructure firms, and asset managers, said it was working to restore normal operations.

The incident did not involve a compromised private key. Instead, the funds were moved through SideSwap, an authorized platform used to facilitate transactions on Liquid. SideSwap said it could not distinguish bitcoin created through the bug from legitimate funds and therefore treated the assets in the same way.

Blockstream said the exploit was linked to a software bug in Elements, the open-source technology underpinning Liquid. Elements is the codebase on which Liquid is built, and because it is open source, fixes to the bug would be expected to flow through public development channels before the network resumes full operation — a point likely to shape how quickly exchanges regain confidence in the settlement layer.

The incident highlights the security risks facing crypto infrastructure as exchanges increasingly rely on blockchain networks and settlement layers to move large amounts of digital assets. Liquid Network is one of the prominent Bitcoin sidechains, designed to enable faster settlement and the issuance of assets between participating institutions, which makes the integrity of its federation wallet a critical component of the ecosystem. Unlike Bitcoin’s base layer, where thousands of independent miners validate transactions, sidechains such as Liquid rely on a federation of named functionaries to sign blocks and custody pegged funds — a design that trades some decentralization for speed, and one whose assumptions are now under scrutiny.

Liquid has not said when transactions will resume or whether the withdrawn bitcoin will be returned. Watch for statements from Blockstream on the Elements patch, from the federation’s members on continued participation, and from the self-described white-hat actors on whether the funds are returned.

A related case study, “Bitcoin Payment Infrastructure Hit by Exploit Targeting Lightning Nodes,” is available here: CASE STUDY | Bitcoin Payment Infrastructure Hit by Exploit Targeting Lightning Nodes.