Liquid Network, the Bitcoin layer-2 sidechain operated by a global federation of crypto exchanges and financial institutions, confirmed a major security incident after roughly 4,000 BTC — wor
Liquid Network, the Bitcoin layer-2 sidechain operated by a global federation of crypto exchanges and financial institutions, confirmed a major security incident after roughly 4,000 BTC — worth approximately $320 million and representing nearly all of the network’s reported reserves — was withdrawn from its federation wallet by unidentified parties claiming to be ethical hackers.
The network has been paused entirely while Blockstream, its lead technical operator, attempts to make contact with those responsible.
How the Incident Unfolded
The withdrawal was disclosed by Liquid Network via its official X account on the evening of September 6:
“We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.”
The scale of the withdrawal is striking relative to the network’s total holdings — the roughly 4,000 BTC removed represents approximately 95% of Liquid’s reported bitcoin reserves, which stood at an estimated 4,200 BTC immediately before the incident occurred. In other words, whoever executed the transaction drained nearly the entirety of the network’s federation-held bitcoin in a single move.
Notably, the individuals or group behind the withdrawal left a direct message embedded in the transaction itself, stating simply: “we are whitehats. contact us on chain.” That on-chain communication is now central to Blockstream’s response, since it suggests the party responsible may be attempting to signal legitimate intentions — a claim commonly associated with security researchers who identify and exploit a vulnerability specifically to prevent malicious actors from doing so first, typically with the intent of eventually returning the funds.
What Blockstream Says Happened Technically
In follow-up statements, Liquid Network provided additional technical detail about how the funds were moved. According to the network’s disclosure, the withdrawal was executed via the SideSwap PAK, or Peg-out Authorization Key — a specific cryptographic mechanism used to authorize the process of moving bitcoin off the Liquid sidechain and back onto the main Bitcoin blockchain.
Critically, Liquid Network stated explicitly that this particular key was not compromised, and clarified that no other keys within the system were compromised either — an important distinction, since it suggests the withdrawal may have exploited a functional or logical vulnerability in how the authorization process works, rather than resulting from a stolen or leaked private key.
Immediate Response and Network-Wide Impact
In the immediate aftermath, Liquid Network took several containment steps. Cryptocurrency exchanges holding LBTC — the tokenized representation of Bitcoin that circulates on the Liquid sidechain — were notified and directed to pause both deposits and withdrawals of the asset while the situation is investigated. The network also temporarily disabled its bridge nodes, the infrastructure responsible for processing transactions moving between the Bitcoin mainchain and the Liquid sidechain. With bridge nodes offline, no new transactions can currently be submitted to the network, effectively freezing all Liquid sidechain activity until the issue is resolved.
Liquid Network was careful to clarify the scope of the incident, stating that other assets issued on the network — including USDT, DePix, and various tokenized real-world assets (RWAs) — were not affected by the security event, with the impact isolated specifically to the federation’s bitcoin reserves and the LBTC token tied to them.
In its statement, the network acknowledged the disruption to users directly:
“Liquid wallets will be impacted, and we’re sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.”
Understanding Liquid Network’s Structure
Liquid Network functions as a layer-2 sidechain built on top of Bitcoin, designed to enable faster and more confidential transactions for cryptocurrency exchanges, traders, and financial institutions than would typically be possible directly on the Bitcoin mainchain. Rather than being controlled by a single company, the network is governed by the Liquid Federation — a decentralized consortium of Bitcoin-focused companies, cryptocurrency exchanges, and financial institutions spread across the globe that collectively manage the network’s operations and security.
Blockstream, the software company that originally developed Liquid Network, continues to serve as its primary technical service provider, though it does not hold unilateral control. Because governance authority is distributed among numerous federation members worldwide, no single individual or organization has complete authority over the network — a structure intended to reduce single points of failure, though this incident raises new questions about how that distributed authority model handles a rapid, large-scale security event.
The “White-Hat” Question
The self-identification of the actors as “white-hat hackers” carries significant weight for how this incident is ultimately resolved, but it remains an unverified claim rather than a confirmed fact at this stage. In cryptocurrency security incidents, parties who move funds during an active exploit sometimes genuinely act to protect the funds from other, less scrupulous attackers who might have discovered the same vulnerability, later negotiating a “bug bounty” arrangement to return the assets in exchange for a reward and immunity from prosecution.
In other cases, however, the “white-hat” framing has historically been used by attackers as a negotiating tactic after the fact, once they realize returning funds may be legally and financially safer than attempting to launder $320 million in stolen bitcoin. Blockstream’s active attempt to establish on-chain communication suggests the company is treating this as an open negotiation rather than a resolved matter.
What Happens Next
As of publication, Liquid Network remains fully paused, LBTC deposits and withdrawals remain suspended across participating exchanges, and Blockstream has not yet confirmed whether contact with the responsible party has been established or whether any funds have been returned.
Given the incident occurred during evening hours and involves an unusually large sum relative to the network’s total reserves, additional details, technical post-mortems, and updates on fund recovery are expected to continue emerging in the hours and days following this initial disclosure.
