The Liquid Network has paused its Bitcoin sidechain after nearly 4,000 BTC — worth approximately $320 million — left the federation wallet through a SideSwap peg-out, cutting the reserve from roughly 4,200 BTC to about 200 BTC.

The security incident unfolded on September 6 and removed roughly 95% of the Bitcoin backing L-BTC. Bridge nodes were subsequently disabled, preventing new transactions from entering Liquid, while exchanges were instructed to suspend L-BTC deposits and withdrawals.

SideSwap Peg-Out Released 3,996 BTC

The withdrawal passed through SideSwap's Peg-out Authorization Key (PAK), which is authorized to request Bitcoin redemptions from Liquid's federation. A customer sent roughly 4,000 L-BTC through SideSwap's peg-out service shortly after 14:05 UTC, and the federation released approximately 3,996 BTC on Bitcoin at 14:28 UTC.

The SideSwap authorization key was not compromised, nor has Liquid identified a compromise of the federation's other signing keys. The L-BTC presented for redemption instead originated from an apparent bug in Elements, the open-source software underlying Liquid. That distinction makes the incident materially different from a stolen bridge key or multisig takeover: the peg-out followed an authorized path, but the L-BTC entering that process should not have existed with corresponding Bitcoin backing. A technical analysis of the exact Elements vulnerability has not yet been published.

Elements is the open-source codebase on which Liquid is built, and because it is publicly developed, any confirmed vulnerability there could have relevance for other projects building on the same software — a reason the pending technical post-mortem is likely to draw broad attention beyond Liquid itself.

Bitcoin Moves to Address Claiming 'Whitehats'

The withdrawn funds were consolidated into a Bitcoin address holding roughly 3,998 BTC. An onchain transaction included the message: "we are whitehats. contact us on chain." Blockstream responded through Bitcoin with contact information for its security team as efforts began to establish communication with the address controllers.

The white-hat characterization remains unverified. Ledger CTO Charles Guillemet questioned the approach, arguing that draining nearly an entire bridge reserve before seeking contact falls outside conventional responsible-disclosure practices. The Bitcoin remained concentrated in the identified address early on September 7 rather than moving through exchanges, mixers, or cross-chain services.

Recent attackers have taken very different paths after obtaining Bitcoin. Funds from the Coldcard Wave 3 attack began moving through THORChain last week, converting BTC into ETH as investigators tracked the new destination addresses. Whether the funds in this case stay put — a precondition for any negotiated return — remains the immediate question for observers tracking the address.

Liquid Remains Paused While Elements Bug Is Investigated

Liquid, developed by Blockstream and launched in 2018, represents BTC locked on Bitcoin as L-BTC on its sidechain, with federation members operating the infrastructure securing peg-ins and peg-outs. USDT, DePix, and other assets issued on Liquid were not directly affected by the unauthorized L-BTC creation, although the network pause prevents normal transaction processing — leaving holders of those assets unable to transact until the network resumes.

The episode also differs from conventional bridge drains such as the $24.15 million AFX Trade exploit, where validator signatures authorized an unauthorized USDC withdrawal from bridge reserves.

As of early September 7, Liquid bridge nodes remained disabled, exchanges were keeping L-BTC deposits and withdrawals suspended, and roughly 3,998 BTC remained at the Bitcoin address connected to the withdrawal. Key open items include whether the address controllers respond to Blockstream's outreach, the publication of a technical analysis of the Elements bug, and the timeline for restoring the reserve backing L-BTC before the network can safely resume.

Source: Crypto Adventure