Liquid Network says it temporarily paused its Bitcoin sidechain after purported "white-hat" hackers withdrew roughly $320 million in Bitcoin from its federation wallet. The actors' intentions remain disputed, and blockchain records already show a large portion of the funds moving back toward a federation-linked address. The pause, first disclosed on September 6, 2026, remains only partially verified, and key details about its scope, the recovery of funds, and the root cause are still unconfirmed.

Liquid Network reported a sidechain pause after an alleged withdrawal it valued at approximately $320 million in Bitcoin. The "white-hat" characterization comes from the actors themselves and remains unverified and contested. The precise scope of the pause and how much has been recovered are still unconfirmed, even as on-chain data shows a partial return of funds.

What Liquid Network Said About the Pause

Liquid Network stated on September 6, 2026 that purported white-hat hackers had withdrawn approximately 4,000 BTC from its federation wallet, according to the project's official incident statement. The figure is the operator's own approximation, not an independently reconstructed reserve accounting. The federation wallet is the custody point for the Bitcoin that backs L-BTC, the sidechain's representative asset: Liquid, built on Blockstream's open-source Elements codebase, operates as a federated sidechain in which a group of functionary members — rather than miners — collectively control pegged Bitcoin and block signing. That design makes the security of federation-held keys, and of the software guarding them, central to the network's trust model.

Liquid put the approximate value of that withdrawal at about $320 million — a figure it described as the incident's estimated size rather than a verified transfer-time price for any single output.

The company said bridge nodes had been temporarily disabled and that no new transactions could be submitted, effectively pausing the sidechain at the time of the announcement. It added that the withdrawal used SideSwap's Peg-out Authorization Key while asserting that this key and the network's other keys had not been compromised. SideSwap is a wallet and exchange built on Liquid, and the reference to its Peg-out Authorization Key indicates the withdrawal path ran through third-party infrastructure connected to the peg-out process rather than a direct breach of the federation's signing keys, according to the operator's own account.

Liquid also said exchanges had been notified and had paused or would pause L-BTC deposits and withdrawals, and that USDT, DePix and other real-world assets issued on Liquid were unaffected by the incident. That statement does not establish whether those assets remained transferable while the network was paused. The exchange notifications follow standard incident practice in crypto: halting deposits and withdrawals of an affected asset is a common containment step designed to prevent tokens that may not be fully backed from being traded or moved during a pause.

Because the announcement came directly from the affected operator, it should be read as the protocol's own account rather than a completed independent postmortem. The full statement is embedded below.

We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn 4,000 BTC ($320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message. What we know so far is that the funds…

— Liquid Network (@Liquid_BTC) September 6, 2026

Source: https://x.com/Liquid_BTC/status/2096696272447218108

Explorer records give a more exact figure than the operator's round number. The withdrawal transaction, confirmed at block 965783 on September 6, 2026 at 14:28:56 UTC, sent exactly 3,996.01834922 BTC to a single output address, with all 83 inputs drawn from one federation-linked address (transaction: 8db751a6…58a7b140).

Why the "White-Hat" Label Is Still Contested

The "white-hat" description originates with the actors, not with an independent finding. A related transaction confirmed September 6 at 18:30:10 UTC carried a decoded OP_RETURN message reading "we are whitehats. contact us on chain," which proves a self-description rather than benevolent intent, authorization, or legal identity. Using OP_RETURN messages to open a negotiation channel is an established pattern in crypto incidents, since Bitcoin transactions provide a publicly verifiable way for parties without other contact information to communicate on-chain.

That distinction matters because the label alone does not establish permission to move the funds, an agreed bounty, or any commitment to return them. On the record so far, the event sits somewhere between a claimed authorized exercise and an outright theft, and the supplied evidence does not settle which.

Ledger Chief Technology Officer Charles Guillemet questioned the white-hat framing, as reported by NFT Plazas, noting that taking hundreds of millions of dollars before disclosure departs from conventional white-hat practice. Under widely cited responsible-disclosure norms, security researchers typically report a vulnerability to the affected party and coordinate remediation before, not after, moving funds at scale. According to unconfirmed reports in that same summary, an Elements software vulnerability allowed unauthorized L-BTC to be created and an existing fix had only been partially deployed; no technical postmortem or patch detail has been independently verified. Elements is the open-source codebase underlying Liquid, and a partially deployed fix across a federation would mean some members were running patched software while others were not — though that deployment split remains unconfirmed.

The Open Questions on Funds and Network Status

The clearest development is on-chain. A transaction confirmed at block 965950 on September 7, 2026 at 16:09:25 UTC returned exactly 3,400 BTC to the same federation-linked address, blockchain records show. That is a returned transfer, not proof of full recovery or that the sidechain has reopened. The remaining roughly 596 BTC unaccounted for in the public record, together with the still-paused sidechain, are the main open items to watch: confirmed resumption of Liquid block production and L-BTC peg-in/peg-out functions, any statement from the actors or their negotiated terms, and eventual disclosure of the technical root cause.

Several widely circulated figures remain unverified. According to unconfirmed reports, the pre-incident reserve was roughly 4,200 BTC with about 95% withdrawn, but the historical wallet balance was not independently reconstructed, and the 4,200 BTC figure should not be treated as the amount taken.

What still needs corroboration is specific: the exact duration and paused functions, the transfer-time dollar basis for the withdrawal, the destination and eventual disposition of the funds, and whether user balances were affected. No regulator or law-enforcement filing has been verified, and "white-hat" carries no legal weight in this evidence set. The incident nonetheless adds to a recurring industry question about federated and bridge custody designs, which have repeatedly concentrated large sums behind a small set of keys or multisig arrangements and, in past incidents across other networks, have been the point of failure when those keys or their surrounding software were exploited.

The market backdrop is calm rather than panicked. Bitcoin traded around $78,677 with a modest 24-hour move, a level that has drawn attention as traders weigh shifting Federal Reserve rate-hike odds and where Bitcoin sat after it reclaimed the $77,500 area. The broad crypto Fear & Greed Index sat at 69, in "Greed" territory — a market-wide reading that cannot be attributed to the Liquid incident and does not signal how Bitcoin's price could respond to any confirmed loss.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.