Bitcoin sidechain halts after 4,000 BTC drained

TLDR

A major exploit on Blockstreams Liquid Network sidechain led to about 4,000 BTC being withdrawn and the sidechain being paused, while Bitcoins mainnet remains unaffected.

1. Liquid Network reports that roughly 4,000 BTC, worth about 320 million dollars, were withdrawn from its federation wallet, prompting a full halt of the sidechain.
2. The incident drained around 95 percent of Liquids BTC reserves and froze LBTC redemptions, raising serious questions about federated bridge and sidechain security.
3. Key unknowns include whether the white hat actors will return funds and what fixes Blockstream will deploy, which will shape trust in Liquid and similar Bitcoin sidechains.

Deep Dive

1. What Happened On Liquid

Liquid Network, a Bitcoin sidechain operated by Blockstream, says approximately 4,000 BTC, about 320 million dollars, were withdrawn from its federation wallet in a single peg out, representing about 95 percent of its reported reserves before the incident. Multiple reports note that the withdrawal used the SideSwap Peg out Authorization Key, with Blockstream stating that the key itself was not compromised, suggesting a bug in its Elements software allowed the exploit. Liquid Network paused all activity and instructed exchanges to suspend LBTC deposits and withdrawals, and bridge nodes were disabled, effectively halting the sidechain.

Crucially, this affected only the Liquid sidechain and its bridge, not the Bitcoin mainnet. The BTC currently sits in a small number of addresses on the Bitcoin chain and had not been widely moved or mixed at the time of reporting, according to detailed incident coverage.

2. Who Is Affected And How

The immediate impact falls on users holding Liquid Bitcoin (LBTC) and other assets that rely on the Liquid bridge. The federation wallet backing LBTC reportedly dropped from about 4,200 BTC to roughly 197 BTC, meaning almost all backing reserves were withdrawn to a single address. As a result, LBTC holders cannot currently redeem 1 to 1 for BTC until the incident is resolved and the peg is restored.

Other assets issued on Liquid, such as USDT and tokenized real world assets, are reported as unaffected on their native chains, but their transfer via Liquid is disrupted because the sidechain is paused. Analysts and researchers highlight that this event exposes the trust and governance risks of federated bridges, where a small group of functionaries and whitelists control peg outs, as described in Blockstream focused reporting.

3. Key Unknowns To Watch

The actors behind the withdrawal embedded an onchain message claiming we are whitehats. contact us on chain, and later indicated a willingness to return funds, but independent analysts and Ledgers CTO have questioned whether this fits normal white hat practice. At the time of writing, the BTC remains largely unmoved, and there is no confirmed deal for its return.

Open questions include how exactly the Elements bug allowed unauthorized L BTC creation and peg outs, whether LBTC will be fully re collateralized, and what architectural changes Liquid will make to its peg and federation design. The eventual response will influence how comfortable users and institutions feel about Liquid specifically and about BTC sidechains and bridges more broadly.

Conclusion

A single exploit on the Liquid Network sidechain drained almost all BTC backing its LBTC token and forced a full pause of the bridge, but Bitcoins base layer remains intact. The episode underlines that using federated sidechains and bridges adds a separate layer of smart contract and governance risk on top of normal BTC custody. How Blockstream and the attackers handle fund return, disclosure, and design changes will determine whether confidence in Liquid and similar Bitcoin sidechain structures recovers or continues to erode.