The Liquid Network has suspended activity on its Bitcoin sidechain after purported white-hat hackers withdrew approximately 4,000 bitcoin, worth roughly $320 million, from the network's federation wallet, according to a statement issued by the project.

The incident, disclosed on Sept. 6, represented about 95% of Liquid's reported Bitcoin reserves. The network held approximately 4,200 BTC in reserves before the withdrawal, making this one of the most significant security events ever to affect the Bitcoin sidechain.

Liquid said the withdrawal forced it to temporarily halt network operations while federation members investigate the incident and work to resolve the security issue.

Blockstream, the network's technology provider, was attempting to establish contact with the responsible parties through a signed message recorded on the Bitcoin blockchain. Liquid described the individuals as purported white-hat hackers but did not disclose their identities or confirm whether the withdrawn Bitcoin would be returned.

Peg-Out Authorization Key Used in Withdrawal

According to Liquid, the funds were withdrawn using the SideSwap Peg-out Authorization Key, commonly known as the SideSwap PAK. The network stated that the key itself had not been compromised and that there was no indication other keys had been breached.

However, Liquid did not disclose the underlying vulnerability that enabled the large withdrawal. The absence of detail leaves open questions about how the transaction was authorized and whether additional safeguards may be required before normal operations can resume.

An on-chain message embedded in a Bitcoin transaction associated with the incident indicated that the individuals behind the withdrawal identified themselves as white-hat hackers and asked Liquid to contact them via the blockchain.

Liquid has notified cryptocurrency exchanges about the incident. Some exchanges have suspended deposits and withdrawals involving LBTC, the Bitcoin-backed token issued on the sidechain, while others were expected to implement similar restrictions.

The network also temporarily disabled its bridge nodes, preventing users from submitting new transactions. The suspension effectively leaves the Liquid sidechain paused until the security incident is resolved, limiting users' ability to move assets through the network.

We are aware of a security incident on @Liquid_BTC . Purported white-hat hackers have withdrawn 4,000 BTC ($320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message. What we know so far is that the funds… — Liquid Network (@Liquid_BTC) September 6, 2026

Other Liquid Assets Reportedly Unaffected

Despite the scale of the Bitcoin withdrawal, Liquid said other assets issued on the network were not affected, including USDT, DePix and various real-world assets.

The network nevertheless warned that the disruption would affect wallets and users attempting to interact with Liquid while bridge infrastructure remains disabled. The temporary restrictions are expected to remain in place until federation members determine that network operations can safely resume.

Liquid is a Bitcoin sidechain, launched by Blockstream in 2018, designed to enable faster and more confidential transactions while supporting the issuance of digital assets. Bitcoin deposited into the underlying Bitcoin network is represented on Liquid through LBTC, with federation members responsible for safeguarding the Bitcoin backing those tokens. The federation model differs from bridge-based designs in that trusted member institutions, rather than a smart-contract protocol, control the movement of funds between the sidechain and the main Bitcoin network — which means incidents involving federation-controlled keys affect the reserves backing user tokens directly.

The federation plays a central role in Liquid's security model, as its members oversee the Bitcoin held to support the sidechain's assets. The withdrawal of such a large portion of those reserves therefore raises significant operational and security concerns for the network, and follows a broader history of large cross-chain and bridge exploits in the crypto sector, such as the Ronin Network and Wormbridge incidents, which prompted industry-wide reassessments of key management and multi-signature safeguards.

Liquid said federation members were working to address the incident and restore normal activity. The project has not provided a specific timeline for restarting the sidechain or disclosed further details about its communication with the purported white-hat hackers.

The incident is likely to keep attention focused on the security of Bitcoin sidechains and the mechanisms used to authorize withdrawals from federated wallets. The outcome of Liquid's investigation — including whether the withdrawn Bitcoin is recovered, how the vulnerability is addressed, and whether the federation adjusts its key-management procedures — will be central to determining when normal operations can resume and whether confidence in the network's reserve model can be maintained.