Bitcoin sidechain pauses after $320M BTC outflow

TLDR

Blockstreams Liquid Network, a Bitcoin sidechain, has paused its network after roughly 4,000 BTC, worth about $320 million, were withdrawn from its federation wallet in a still-unresolved security incident.

1. Purported white-hat hackers used Liquids peg-out mechanism to withdraw around 4,000 BTC, representing about 95% of its reserves, prompting Liquid to disable bridge nodes and halt activity.
2. LBTC deposits and withdrawals on exchanges have been suspended, but reports say the peg remains solvent and other assets on Liquid such as USDT are technically unaffected, though confidence is shaken.
3. The BTC remains at a single address and Blockstream is trying to contact the white hats, leaving open questions about the vulnerability and whether funds will be returned.

Deep Dive

1. What Happened On Liquid

Liquid Network reported that approximately 4,000 BTC, about $320 million, were withdrawn from its federation wallet via the SideSwap Peg-out Authorization Key, leading it to pause the sidechain and disable bridge nodes. Coverage by The Block notes that this was roughly 95 percent of Liquids reported reserves, dropping the wallet from about 4,200 BTC to around 200 BTC before the pause.

Several outlets describe the actors as purported white-hat hackers, citing an on-chain message attached to a transaction that reads we are whitehats. contact us on chain. The Defiant and others add that the withdrawal used a valid authorization key rather than a stolen one, which is unusual and leaves the precise bug or logic failure unexplained. Bitcoin.com reports that a bug in Blockstreams Elements software allowed creation of L-BTC that then pegged out to real BTC, triggering the incident.

2. Impact On Users, LBTC And Bitcoin

Liquid has instructed exchanges to suspend deposits and withdrawals of Liquid Bitcoin (LBTC), and bridge nodes have been disabled, effectively pausing all new transactions on the sidechain. Multiple reports say other assets issued on Liquid, such as USDT and tokenized real-world assets, are not directly affected in terms of backing, but functionality for users is disrupted while the network is paused.

Yahoo Finance and other analysis note that the peg mechanism burned L-BTC as BTC left, so there is no immediate insolvency for LBTC holders, but Liquids reserves are now concentrated off-chain with the white hats. For Bitcoin itself, this is a localized incident on a federated sidechain: base-layer BTC is not compromised, yet the episode reinforces broader concerns around sidechain and bridge security.

3. What To Watch Next

So far, the withdrawn BTC remains largely unmixed at a single address, which commentators like DBCrypto and The Defiant view as behavior consistent with a white-hat extraction, though that intention is still unconfirmed. Blockstream has responded with its own on-chain message asking the holder to contact its security team, and federation members are reportedly working to restore operations.

Key open questions are: how exactly the Elements bug or authorization path allowed this withdrawal; whether Blockstream can negotiate a return of funds; and what changes will be made to Liquids multisig and whitelist controls. For users, the practical triggers to watch are any official Liquid or Blockstream statements confirming a fix, the status of LBTC deposits and withdrawals on exchanges, and whether the sidechain resumes with updated security guarantees.

Confidence: moderate because multiple independent reports agree on the facts, but the root cause and outcome are not yet fully disclosed.

Conclusion

The pause of Liquid Network after a 4,000 BTC peg-out is a significant stress test for Bitcoin sidechains, highlighting that complex bridge logic can fail even when keys are not overtly compromised. For crypto users, the lesson is that settlement and bridge layers carry their own security and governance risks distinct from Bitcoin itself. The eventual handling of these funds and the fixes Liquid adopts will shape how much trust sidechains retain as infrastructure for large-scale BTC movement.