BTC sidechain halts after 4,000 BTC drained

TLDR

A major Bitcoin sidechain, Blockstreams Liquid Network, has paused after roughly 4,000 BTC were withdrawn from its custody under disputed white hat claims.

1. Around 4,000 BTC, about 95% of Liquids reserves, left the federation wallet, prompting Liquid to halt the sidechain and suspend LBTC deposits and withdrawals.
2. Blockstream says a bug in its Elements software let LBTC be created and pegged out, raising serious questions about sidechain and bridge security, not Bitcoins base layer.
3. The BTC now sits in a few addresses, with the sender calling themselves white hats; the key questions are whether funds return and how the protocol is rebuilt and audited.

Deep Dive

1. What Happened To Liquid

Reports say Liquid Network, a Bitcoin sidechain operated by Blockstream, paused operations after about 4,000 BTC (roughly 320 million dollars) were withdrawn from its federation wallet, about 95% of its reported reserves. Multiple outlets note the withdrawals used Liquids peg out process via the SideSwap Peg out Authorization Key, after 4,000 LBTC were sent into SideSwaps peg out service and 3,996 BTC paid out 20 to 30 minutes later.

Liquid has disabled bridge nodes and told exchanges to suspend deposits and withdrawals for Liquid Bitcoin (LBTC), effectively freezing the sidechain while the incident is investigated. Other assets issued on Liquid, such as USDT and tokenized real world assets, are reported as structurally unaffected but currently cannot move while the network is paused.

2. Why It Matters For Users

Blockstream later attributed the event to a bug in its Elements software that allowed LBTC to be created in a way the system treated as valid, then pegged out to real BTC, even though keys were not stolen. That undermines confidence in Liquids core security model, which relies on an 11 of 15 federation multisig plus peg out whitelists to protect custodial BTC.

For Bitcoin holders on the main chain, the incident does not compromise the Bitcoin network itself, but it highlights that any BTC bridged or sidechained depends on the correctness of that bridges code and governance. Users holding LBTC or other assets on Liquid face counterparty and technical risk while reserves and accounting are clarified.

3. Where The BTC Is And What To Watch

The withdrawn BTC appear consolidated into a small number of addresses, with an on chain message reading we are whitehats. contact us on chain, and a later message from Blockstream asking them to contact a security email. The coins have reportedly not been mixed, which is consistent with at least the possibility of a negotiated return.

Key things to watch next are: 1) whether any portion of the 4,000 BTC is returned, 2) a detailed postmortem explaining the exact Elements bug and how it will be fixed, and 3) when exchanges and the Liquid federation feel confident enough to re enable LBTC transfers and bridge operations.

Conclusion

Liquids halt after nearly all of its BTC reserves were withdrawn shows how a single software flaw in a sidechain or bridge can endanger large custodial balances even when keys are not stolen. For Bitcoin itself, the incident is another reminder that on chain BTC and synthetic representations like LBTC carry very different risk profiles, and that bridge and sidechain security should be treated as a primary, not secondary, concern.