Hassan Maishera
TL;DR
-
Purported white-hat hackers withdrew approximately 4,000 BTC, worth about $320 million, from Liquid Network’s federation wallet.
-
The funds represented roughly 95% of the network’s reported Bitcoin reserves before the incident.
-
Liquid said the withdrawal occurred through SideSwap’s Peg-out Authorization Key but maintained that the key was not compromised.
-
Bridge nodes have been disabled, effectively pausing the Bitcoin sidechain.
Liquid Network Pauses Operations After $320 Million Bitcoin Withdrawal
Liquid Network paused its Bitcoin sidechain on Sunday after purported white-hat hackers withdrew approximately 4,000 bitcoin from its federation wallet.
The assets were worth about $320 million at the time and represented roughly 95% of Liquid’s reported bitcoin reserves. The network reportedly held around 4,200 BTC before the incident.
“We are aware of a security incident on @Liquid_BTC,” Liquid said in a Sept. 6 post on X.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
What we know so far is that the funds…
Blockstream, Liquid’s technology provider, is attempting to contact the parties responsible using an onchain signed message. Liquid has not identified the parties or confirmed whether they have agreed to return the bitcoin.
A message embedded in a Bitcoin transaction linked to the withdrawal suggested that the people behind the transaction did not intend to steal the funds permanently.
“We are whitehats. Contact us on chain,” the message read.
White-hat hackers typically identify vulnerabilities in computer systems and may remove or secure funds to prevent malicious actors from exploiting the same weakness. However, Liquid has not confirmed the identity or intentions of the parties involved.
The network also has not disclosed whether it has established contact with them or received assurances that the funds will be returned.
Withdrawal Involved SideSwap Authorization Key
Liquid said the funds were withdrawn using SideSwap’s Peg-out Authorization Key, commonly known as a PAK. It maintained that neither that key nor any other authorization keys had been compromised.
The network did not explain the underlying vulnerability that allowed the transaction to take place despite the keys reportedly remaining secure.
Peg-outs allow users to move bitcoin-backed assets from the Liquid sidechain back to the Bitcoin network. Federation operators are responsible for authorizing these transactions and protecting the underlying BTC reserves.
Liquid notified cryptocurrency exchanges about the incident, prompting platforms to suspend—or prepare to suspend—deposits and withdrawals involving LBTC, the sidechain’s bitcoin-backed token.
The network also temporarily disabled its bridge nodes, preventing users from submitting new transactions.
“Effectively, the Liquid sidechain is paused until this issue is resolved,” Liquid said.
The suspension is intended to prevent further activity while federation members investigate the incident and work toward restoring the network.
Other Liquid-Issued Assets Remain Unaffected
Liquid said other assets issued on the sidechain, including USDT, DePix and tokenized real-world assets, were not directly affected by the withdrawal. However, the network warned that wallets would experience disruption while activity remained paused.
Liquid is a Bitcoin sidechain designed to enable faster and confidential transfers while supporting the issuance of digital assets. Bitcoin locked on the main network is represented on Liquid as LBTC, with federation members responsible for safeguarding the corresponding reserves.
The federation is working to resolve the incident and resume normal operations. Liquid has not provided a timeline for restarting the network or disclosed details of its communications with the purported white hats.
