TL;DR:
- Liquid paused after purported white hats withdrew about 4,000 BTC worth $320 million, representing roughly 95% of the federation wallet’s Bitcoin balance.
- SideSwap said its authorization key was not compromised, instead pointing to an Elements bug that apparently enabled unbacked L-BTC to be redeemed.
- The actors offered to return most funds after the vulnerability is patched across every node, while Bitcoin’s main network and other Liquid assets remained unaffected overall.
Liquid Network halted operations after actors describing themselves as white-hat hackers withdrew about 4,000 BTC, worth roughly $320 million, from the federation wallet backing L-BTC. The scale of the withdrawal immediately turned a technical incident into a systemic test for the sidechain, because the amount represented about 95% of the wallet’s roughly 4,200 BTC balance. Liquid disabled bridge nodes on Sunday, preventing new transactions, while exchanges halted or prepared to halt L-BTC deposits and withdrawals. Other Liquid-issued assets, including USDT, DePix and tokenized real-world assets, remained unaffected, raising immediate questions about network resilience and safeguards.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds…
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
The transaction path adds an unusual layer to the incident. SideSwap said a customer sent 4,000 L-BTC to its peg-out service at 14:05 UTC, with the tokens burned under valid authorization before 3,996 BTC left the federation 23 minutes later. SideSwap says its Peg-out Authorization Key was not compromised and instead points to a bug in Elements, the open-source software underpinning Liquid. The mechanism apparently allowed unbacked L-BTC to be created and then redeemed through what looked like a normal peg-out, leaving the federation wallet with roughly 200 BTC without obvious warning to network operators.
Blockstream Opens Onchain Talks With The Purported White Hats
The actors then identified themselves through an onchain message as white hats and asked Blockstream to contact them. Blockstream responded with an email address, and the exchange continued through PGP-signed or encrypted messages embedded in Bitcoin transactions. The group offered to return most of the Bitcoin, but only after the vulnerability is patched and every node is updated. At the time covered by the reports, the funds had not been returned. Around 3,998.5 BTC remained unmoved, while Blockstream’s response indicated willingness to continue the recovery discussion as the network stayed paused during the standoff itself.
That condition has made the episode more perplexing than a conventional exploit. The actors claim defensive intent, yet they still control nearly all the Bitcoin removed from the federation wallet, and the disputed funds underpin L-BTC issued on Liquid. The immediate priority is therefore both technical remediation and restoration of confidence in the sidechain’s backing model. Bitcoin’s main network was not affected, and other Liquid assets remained untouched. Still, until the vulnerability is fixed across the network and the withdrawn Bitcoin is returned, Liquid faces an unusual security negotiation with consequences for users and exchanges.
