Liquid Network Calls Withdrawal of Approximately 4,000 BTC a Hack and Suspends Operations
Liquid Network called the withdrawal of approximately 4,000 BTC from the federation’s wallet a hack. According to the project, alleged “white-hat” hackers withdrew the funds through SideSwap, and the key used was not compromised. The exact technical mechanism and timeline for restoring the network remain unknown.
Liquid Network incident led to the temporary suspension of operations on the federated Bitcoin sidechain. On September 6, the project said approximately 4,000 BTC had been withdrawn from the Liquid Federation wallet, worth about $320 million at the time of the announcement. Liquid subsequently deactivated the bridge nodes, stopping the acceptance of new transactions on its network.
According to the announcement, exchanges were informed of the situation. Deposits and withdrawals of LBTC, the token representing Bitcoin used on the Liquid network, were suspended or were expected to be suspended. Liquid Network subsequently called the incident a hack and said approximately 4,000 BTC had been withdrawn by alleged “white-hat” hackers. However, the project did not disclose their identities or the exact technical mechanism that authorized the withdrawal, and it did not provide a schedule for the network’s return to operation.
Liquid Network incident halted the bridge and transactions
Liquid operates as a federated Bitcoin network. Bitcoin reserves are managed by a group of federation members, with LBTC used against them on the sidechain. Bridge nodes connect the Bitcoin network with Liquid; their deactivation therefore restricted the movement of funds between the two networks and the processing of new transactions on Liquid.
The project said the withdrawal went through the SideSwap Peg-out Authorization Key, known by the abbreviation PAK. According to Liquid, neither this nor any other key was compromised. However, the statement itself does not explain the mechanism by which the withdrawal was carried out.
In a message included in a Bitcoin transaction, the person or people who moved the BTC identified themselves as “white hats.” This designation alone does not confirm their identity, motivation, or intention to return the funds. It is likewise unconfirmed whether this involved exploiting a vulnerability in Elements software or in the SideSwap service.
What it means for LBTC holders
For LBTC users and services dependent on Liquid, the outage has an immediate operational impact. While the bridge nodes are deactivated, deposits, withdrawals, and the receipt of new transactions on the sidechain cannot normally be carried out. Specific restrictions may vary among exchanges, wallets, and other providers according to their own procedures.
Liquid said the incident did not affect other assets on the network. However, this is the project’s claim; service restrictions may continue while the sidechain remains suspended. Users should therefore monitor announcements from the specific exchange or wallet through which they use LBTC.
Questions surrounding reserves and peg-out controls
The incident is also significant given Liquid’s model. The network does not rely on Bitcoin’s decentralized mining consensus, but on a federation of reserve custodians. The withdrawal of approximately 4,000 BTC without a public technical explanation therefore raises questions about peg-out process controls and LBTC backing during the outage.
Blockstream is the technology provider for Liquid Federation, but Liquid operates as a federated network. Liquid called the incident a hack, but the exact technical mechanism remains unclear. The information released so far does not make it possible to determine whether the attackers exploited a flaw in a specific process, a software vulnerability, or another weakness in peg-out authorization.
What to watch next
- An official technical explanation of the withdrawal and confirmation or refutation of a vulnerability.
- Verifiable return of approximately 4,000 BTC or an agreement with the people who identified themselves as “white hats.”
- Information about the fix, reactivation of the bridge nodes, and restoration of Liquid.
- How exchanges and wallet providers proceed when reopening LBTC deposits and withdrawals.
Sources
- Reuters – On September 7, Reuters reported, citing Liquid Network, that approximately $320 million had been withdrawn in a hack; the project attributed the attack to alleged “white-hat” hackers and said the key used was not compromised.
- Liquid Network – official statement on X – Liquid announced a security incident, the withdrawal of approximately 4,000 BTC, the deactivation of bridge nodes, and efforts to contact the people responsible for the transaction.
- The Block – Independently summarizes the announcement, the sidechain suspension, LBTC restrictions, and the unexplained technical mechanism of the incident.
- Liquid Network – Confirms that Blockstream is the technology provider for Liquid Federation and that Liquid operates as a federated Bitcoin network with LBTC and issued assets.
Verified and updated: 09/07/2026 07:32
