Blockstream's Liquid sidechain has been paused since Sunday, after roughly 4,000 BTC worth about $320 million left the federation wallet that backs every L-BTC in circulation.

Liquid, launched by Blockstream in 2018, is a federated Bitcoin sidechain used mainly by exchanges and trading firms for faster settlement and issued assets; its L-BTC tokens are supposed to be backed one-for-one by bitcoin held in the federation wallet, which is why unbacked L-BTC strikes directly at the network's core promise.

SideSwap, a federation member operating a peg-out service, said a customer sent it 4,000 L-BTC at 14:05 UTC. The tokens were burned under a valid authorization, and 23 minutes later the federation paid out 3,996 BTC.

We are aware of a security incident on @Liquid_BTC . Purported white-hat hackers have withdrawn 4,000 BTC ($320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message. What we know so far is that the funds… — Liquid Network 🌊 (@Liquid_BTC) September 6, 2026

Liquid said the funds moved through SideSwap's Peg-out Authorization Key, but that neither that key nor any other federation key was compromised. SideSwap likewise stated that none of its systems were breached, pointing instead to a bug in Elements, the open-source software that Liquid runs on.

Blockstream has not explained the bug, although a fix had been added to Liquid's underlying software five weeks earlier (Elements commit). Nothing was forced out of the wallet: someone created L-BTC that no Bitcoin was backing, then cashed it in through a peg-out that appeared ordinary. That gap between the fix landing upstream and federation members actually running patched software is the immediate question hanging over the incident.

The wallet held around 4,200 BTC before Sunday and roughly 200 afterward—about 5% of its prior balance.

Talking to the supposed white hats

The party left an on-chain message reading "we are whitehats. contact us on chain." (transaction) Blockstream answered an hour later with an email address, and the two sides have since exchanged PGP-signed messages embedded in Bitcoin transactions.

The hackers offered to return most of the coins, then attached a condition: patch the bug first, because the chain is still at risk at the latest commit, and update every node. Blockstream's reply—"Yes, thank you"—answered the earlier offer and was confirmed in the same block as the condition. The outcome now hinges on whether every federation functionary upgrades in time for the chain to resume safely with full backing restored.

Ledger chief technology officer Charles Guillemet initially argued that "White hats don't drain a bridge and then solicit an 'on-chain' contact," likening the episode to the Ronin and Euler hacks—two of the largest exploits in crypto history, in which attackers made off with hundreds of millions before partial recoveries were negotiated. He briefly allowed that they might be people who "intensively played with recent LLMs," then hardened his stance once the condition appeared: white hat practice has "changed," he wrote, adding that, "Now they steal the money and refuse to give back the funds before the vulnerability is fixed..."

Former Blockstream security chief Samson Mow, who published a timeline of the exchange, puts the hackers' address at about 3,998.5 BTC.

Other assets on Liquid, including USDT, DePix and tokenized real-world assets, were untouched, and Bitcoin's own network is unaffected.