The Liquid Network has paused its bitcoin sidechain after purported white-hat hackers withdrew an estimated $320 million in bitcoin from the Liquid Federation wallet, according to an official incident statement. The protocol has disabled bridge nodes and halted new transaction submissions while it investigates. The figures are preliminary protocol estimates, and the actors' intent, authorization, and any recovery remain unverified.

The incident puts an unusually bright spotlight on Liquid's core design trade-off. Launched by Blockstream in 2018, Liquid is a federated sidechain: rather than relying on proof of work, a set of geographically distributed functionaries collectively sign blocks and custody the two-way peg that moves bitcoin in and out of the network. That federation model trades trustless validation for faster, confidential settlement — the same multisignature custody arrangement that this reported withdrawal drew directly from.

What the Reported Pause Involves

The pause was disclosed in an official incident statement from the protocol, which said the purported white-hat hackers withdrew approximately 4,000 BTC from the Liquid Federation wallet, a multisignature peg custody set managed by the network's functionaries.

Liquid valued the outflow at approximately $320 million, describing it as a reported withdrawal rather than a confirmed permanent loss. That $320 million figure is the protocol's own estimate, not a transfer-time valuation tied to a verified transaction hash or historical bitcoin price.

The network said bridge nodes had been temporarily disabled, which prevents new transaction submissions and effectively pauses the Liquid sidechain until the issue is resolved. For Liquid users, that means peg-ins, peg-outs, and on-chain movement of Liquid-native assets are stalled while the federation halts block progression.

According to the statement, the withdrawal used the SideSwap Peg-out Authorization Key (PAK), while the protocol asserted that this key and its other keys were not compromised. The underlying mechanism — how a withdrawal was executed through a PAK without a key compromise — is not established by the available evidence and should not be presented as a confirmed exploit path.

Details the Supplied Context Does Not Establish

No independent block-explorer entry, transaction hash, sender or receiver address, or confirmed transfer timestamp was available to corroborate the movement. A separate report circulated an exact figure of 3,998 BTC, but the official statement says only approximately 4,000 BTC, and the precise figure has not been verified.

Liquid said exchanges had been notified and had paused, or would pause, LBTC deposits and withdrawals, though no individual exchange confirmation was available. The protocol also stated that USDT, DePix, and real-world assets issued on Liquid were unaffected, while warning that Liquid wallets would be impacted — an attributed asset-impact assessment rather than proof of uninterrupted settlement.

Why the 'White-Hat' Characterization Needs Verification

Claimed Intent and Authorization

The statement describes the actors as purported white-hat hackers, a qualifier signaling that the network has not confirmed their identity, intent, or authorization. No disclosure agreement, bug-bounty scope, or actor self-description was available to substantiate a benevolent classification.

Liquid said Blockstream was working to contact the purported hackers on-chain using a signed message, referencing an officially linked monitoring address. The available evidence did not establish any response from the actors or any return of funds.

A Withdrawal Does Not Establish Recovery or Final Loss

A withdrawal from the federation wallet is not, on its own, evidence of either a permanent loss or a successful rescue. Whether the bitcoin is recoverable, whether custody sits with cooperative actors, and whether funds will be returned are unresolved questions, not settled facts.

The Liquid Federation's security model separates duties between functionaries. The protocol's August 2023 architecture documentation describes Watchmen managing the multisignature wallet, peg-outs, and UTXO sweeping, with Blocksigner coordinating Liquid block signatures. How those roles interacted with a PAK-authorized withdrawal is precisely the mechanism that no independent postmortem has yet explained.

What Remains Unknown About the Pause and the Funds

Scope of the Pause and Service Status

The precise set of affected functions, the degree of user exposure, and any restart timeline are not established by the available material. The statement confirms bridge nodes were disabled and the sidechain paused, but does not specify resumption conditions or a governance path back to normal operation.

Fund Custody and Recovery Status

Current custody of the bitcoin, and whether any portion has moved since the initial disclosure, is unverified. Confirming the incident would require an attributable, timestamped incident summary, a verifiable on-chain transaction linking the federation wallet to a destination, and an operational update from the network before further claims can be added. For readers tracking the story, those artifacts — an exchange-by-exchange confirmation of LBTC pauses, a transaction-linked postmortem, and a signed response from the monitoring address — are the concrete markers that would move the incident from reported to verified.

Broader market conditions offer no signal on the incident: bitcoin traded at $79,847 with a flat 24-hour move at the time of retrieval, and no event-window analysis attributes any price action to the pause. This is a snapshot only, not a demonstrated reaction, and bitcoin's near-term price outlook should be treated as unrelated to the pause absent further evidence.