The Liquid Network halted activity on Sunday after purported white hat hackers withdrew approximately 4,000 Bitcoin (BTC) from its federation wallet, funds worth roughly $320 million at the time of the incident. Liquid disclosed the September 6 security event in a post on X.

We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn 4,000 BTC ($320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message. What we know so far is that the funds… — Liquid Network 🌊 (@Liquid_BTC) September 6, 2026

https://x.com/Liquid_BTC/status/2096696272447218108

The withdrawal represented about 95% of the network's reported Bitcoin reserves. Before the incident, the federation wallet held roughly 4,200 BTC. Liquid did not confirm in its announcement that the funds would be returned. "White hat" is a term used in the security industry for actors who exploit vulnerabilities and claim to intend to return stolen funds or disclose the flaw, and past incidents involving self-described white hats have ended with varying outcomes, so the label itself is no guarantee of restitution.

What Is Known About the White Hat Hackers?

A Bitcoin transaction linked to the incident carried an on-chain message that read: "We are whitehats. Contact us on chain."

Blockstream, the company that develops Liquid's infrastructure, attempted to contact the alleged white hat hackers via a signed message on the Bitcoin blockchain. Neither the parties involved nor the specifics of the communication have been disclosed.

Liquid stated that the withdrawal was processed through the Peg-out Authorization Key, commonly known as PAK. The company said the PAK key, along with any other keys, was not compromised.

PAK restricts peg-out functionality to registered accounts and approved Bitcoin addresses. The restriction governs where the federation can send BTC during a withdrawal. That the funds moved without any key being compromised suggests the issue may lie in how the peg-out process was invoked rather than in key theft, though Liquid has not released details about the vulnerability, and no such conclusion can be drawn yet.

No information has been released about the vulnerability the alleged white hat hackers exploited.

Why Did Liquid Suspend Network Activity?

In response to the incident, Liquid shut down its bridge nodes, preventing users from sending transactions to the blockchain network. Bridge nodes connect users' nodes to the federation's functionary servers. Halting bridge nodes is a common containment measure for federated sidechains, because unlike Bitcoin itself, there is no independent miner network to keep validating transactions if the federation's operators withdraw participation.

Cryptocurrency exchanges were notified of the security breach and, according to the statement, had either already halted accepting and withdrawing LBTC or were preparing to do so. Because LBTC trades at parity with BTC only while the peg is trusted, prolonged suspension of peg-outs typically pressures exchanges and users holding the sidechain asset, as was seen during earlier outages on other wrapped or federated Bitcoin products.

Liquid said the USDT, DePix, and fiat currencies issued on the sidechain were not affected by the breach, although disruptions to wallets are expected.

Federation members are working to resolve the issue and resume operations. According to the statement, the sidechain will remain offline until the matter is resolved. Key open questions for observers include whether the on-chain dialogue between Blockstream and the purported white hats results in a return of funds, whether the vulnerability is disclosed, and how the federation changes its peg-out controls before reopening.

How Does Liquid Secure Its Bitcoin Reserves?

The Bitcoin withdrawn was part of the Liquid network's reserves. In normal operation, users deposit BTC into the federation wallet in exchange for an equal amount of LBTC, a process known as a peg-in. The reverse procedure, a peg-out, requires a federation member to destroy the LBTC before the Bitcoin is released. Users running a Liquid node can verify the LBTC supply against the Bitcoin held by the federation.

According to Blockstream's documentation, 15 federation members hold keys to the reserve wallet, which are secured in hardware security modules. For Bitcoin to leave the wallet, 11 members must sign a standard peg-out transaction. This multi-signature design is a trust model distinct from Bitcoin's proof-of-work: security depends on the honesty and operational discipline of the federation members rather than on economic incentives for anonymous miners.

Liquid runs on Elements, an open-source software platform built on the Bitcoin protocol. Unlike Bitcoin, it relies on the signatures of federation members rather than miners for block confirmation, producing one-minute blocks under normal conditions.

The network also supports tokens representing various asset types, such as fiat currencies and securities. Confidential transactions conceal transfer amounts and asset types from third-party observers, and LBTC is used to pay transaction fees.

The project was founded in 2018 to speed up transfers between exchanges, brokers, and other users. Liquid's first block was mined on September 27, with the official announcement following on October 10. At launch, the network had 23 participants, including Bitfinex, OKCoin, BitMEX, and SIX Digital Exchange. The initial transaction settlement time was two minutes.