Liquid Network Halts Operations After ~4,000 BTC ($320M) Withdrawn in White-Hat Incident
Key Takeaways
- •Approximately 4,000 BTC, worth about $320 million at the time, was withdrawn from the Liquid Federation wallet, prompting the network to pause operations.
- •The actors claim to be white-hat hackers and have told Blockstream via signed Bitcoin messages that they will return most of the funds after the Elements software flaw is fixed and all nodes are updated.
- •SideSwap processed the peg-out of 4,000 L-BTC with a valid authorization and says its systems were not breached, though Blockstream described the L-BTC involved as bugged due to the Elements flaw.
- •Several exchanges have suspended or plan to suspend L-BTC deposits and withdrawals, while other Liquid assets such as USDT, DePix, and real-world assets were not impacted.
- •As of the latest update, the roughly 4,000 BTC has not been returned, and Liquid remains on hold pending the network-level response from Blockstream and Federation members.
Liquid Freezes Bitcoin Operations
Bitcoin sidechain Liquid has paused network activity after roughly 4,000 BTC was withdrawn from its Federation wallet in a security incident. The actors behind the withdrawal have claimed to be white-hat hackers and have told Blockstream they intend to return most of the funds once the underlying software flaw is fixed.
Following the incident, the functionality of Liquid bridge nodes was briefly suspended, making it impossible to submit new transactions on the network. Exchanges have also been notified, and some have suspended — or are planning to suspend — L-BTC deposits and withdrawals, underscoring how quickly issues at the protocol layer can affect user access across connected services.
The withdrawn amount constitutes a significant portion of the Bitcoin held in the Federation wallet. Liquid confirmed that a total of approximately 4,000 BTC, worth about $320 million at the time of the incident, was removed.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn 4,000 BTC ($320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message. What we know so far is that the funds…
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
The network stated that other assets on Liquid — such as USDT, DePix and real-world assets — were not impacted. The incident concerns L-BTC, Liquid's Bitcoin-backed asset. Each user can peg out L-BTC, which releases an equivalent amount of Bitcoin from the network's Bitcoin reserves.
SideSwap Says Its Systems Were Not Compromised
According to SideSwap, a customer used its peg-out service to bring 4,000 L-BTC into its system at 14:05 UTC. A valid peg-out authorization was received and then paid out to the Bitcoin address at 14:28 UTC: 3,996 BTC were sent, with a transaction fee of 0.007 BTC.
SideSwap stated that its Peg-out Authorization Key was not hacked and that its systems were not breached. Blockstream, however, described the L-BTC involved in the transaction as "bugged" — a result of a flaw in Elements, the open-source software used to build Liquid.
SideSwap said that, because the transaction was properly authorized, it had no practical way to distinguish the problematic L-BTC from normal ones.
Hackers Promise to Return Most BTC
The actors have communicated with Blockstream via signed Bitcoin messages. Alex Thorn, chief research officer at Galaxy Digital, detailed the exchange, noting that the group directed Blockstream to fix the vulnerability before any recovery takes place.
In one message, the actors said they would send most of the Bitcoin back to the Federation address after confirming that every Liquid node had been updated. They also sent encrypted technical information to Blockstream via PGP. Small Bitcoin transfers between the group provide on-chain evidence of communication with the federation. As of the last update, the funds have not yet been returned.
Liquid remains on hold while Blockstream and Federation members work on the network-level response. SideSwap has also restricted new peg-ins and peg-outs and halted new deposits until services are officially resumed.
The roughly 4,000 BTC remain at the center of an ongoing recovery process, with the next phase dependent on fixing the Elements vulnerability across the Liquid network.
Source: CryptoNinjas
