The Liquid Network suffered a major security incident on September 6, when nearly 4,000 BTC—worth approximately $320 million—moved out of its federation wallet. The breach forced the Bitcoin sidechain to halt operations while Blockstream investigated the unauthorized withdrawal.

Liquid, a Bitcoin sidechain launched by Blockstream in 2018, is designed to enable faster settlement and asset issuance between exchanges and traders. Its circulating asset, Liquid Bitcoin (LBTC), is backed on a one-to-one basis by Bitcoin held in the network’s federation wallet.

Liquid described the actors involved as “purported white-hat hackers,” though their intentions remain unconfirmed. An on-chain message claimed the attackers were white hats and asked the network to contact them. Blockstream has since attempted to establish communication through the blockchain.

The incident has raised immediate questions about the security of Liquid’s Bitcoin peg and the controls governing withdrawals from its federation wallet.

Liquid pauses network activity

The transferred funds moved through a peg-out transaction that released Bitcoin from the reserves backing Liquid Bitcoin (LBTC). On-chain data showed that approximately 3,996 BTC reached an external Bitcoin address.

In response, Liquid paused the network and took steps to limit further activity. Exchanges also moved to suspend LBTC deposits and withdrawals as the investigation continued.

The breach did not involve a compromise of the Bitcoin base layer. Instead, the incident centers on Liquid’s federation and the mechanisms used to authorize peg-outs. Peg-outs require signatures from a threshold of the network’s functionaries, the federation members who collectively manage the multisignature wallet securing the pegged Bitcoin.

Funds remain uncertain

The biggest unanswered question is whether the Bitcoin has actually been lost.

The on-chain message suggests the unidentified party may claim to have removed the funds as a security measure. However, that claim has not been independently established. Until the Bitcoin is returned or the actors provide convincing evidence, the funds should be treated as potentially compromised.

The incident also draws renewed attention to the risks surrounding federated Bitcoin bridges. Liquid relies on a group of federation participants to safeguard the Bitcoin backing its sidechain assets.

For users and investors, the immediate focus is on whether Blockstream can recover the funds and determine how the unauthorized withdrawal occurred. The outcome could also affect confidence in Liquid and other systems that depend on custodial or federated infrastructure. Key details to watch going forward include whether communication with the unidentified actors succeeds, how the federation’s signing process was bypassed or abused, and what changes Blockstream makes to the network’s peg-out controls in the aftermath.