TLDR
Bitcoin sidechain Liquid Network has been paused after actors withdrew around 4,000 BTC, worth roughly 320 million dollars, from its federation wallet in a major security incident.
- Purported white-hat hackers exploited a bug in Liquids underlying software to mint and withdraw almost 95 percent of the sidechains Bitcoin-backed reserves.
- Liquid has halted bridge nodes and LBTC transfers, but mainnet Bitcoin and other Liquid-issued assets are reported as unaffected, concentrating impact on sidechain users and confidence in bridge security.
- The key variables now are whether Blockstream patches the Elements bug safely and whether the hackers actually return most of the BTC as claimed.
Deep Dive
1. What Actually Happened
Liquid Network, a Bitcoin (BTC) sidechain run by Blockstream and a federation of members, reported that actors claiming to be white-hat hackers withdrew about 4,000 BTC, worth around 320 million dollars, from the Liquid Federation wallet, or roughly 95 percent of its reported reserves.[^1]
The withdrawal passed through SideSwaps peg-out service using its Peg-out Authorization Key (PAK), but both Liquid and SideSwap say the key itself was not compromised; instead, L-BTC had been created via a bug in Elements, the open-source software that powers Liquid.[^2]
After spotting the issue, Liquid disabled bridge nodes and halted new transactions, effectively pausing the sidechain while Blockstream communicates with the hackers through signed on-chain messages.[^3]
This is closer to a bridge/sidechain accounting bug than a Bitcoin protocol failure, but it still removed control over a large pool of BTC held for users.
2. Who Is Impacted And How
Liquid has told exchanges to suspend deposits and withdrawals of Liquid Bitcoin (LBTC), and Liquid wallets and services like Aquas Liquid functionality are affected while the network is paused.[^1][^2]
Reports state that other assets issued on Liquid, such as USDT, DePix, and tokenized real-world assets, were not directly compromised, though users cannot move them while bridge nodes are down.[^1][^3]
Bitcoin mainnet itself is unaffected, but the incident has added to market concerns about the security of sidechains and bridge-style infrastructure that custody large pools of BTC.[^2][^4]
3. What To Watch Next
The hackers wrote on-chain that they are whitehats and have indicated they will return most of the BTC after Liquid patches the bug and updates all nodes, but as of the latest reports the funds remain under their control.[^3]
Blockstream is working on an Elements fix and coordinating with federation members; the network will likely only resume normal operation once the vulnerability is understood, patched, and reviewed.[^2][^3]
Security experts, including Ledgers CTO, have questioned whether this behavior truly matches standard white-hat practice, so there is still real recovery and trust risk until coins move back and Liquid publishes a clear postmortem.[^3]
Conclusion
A serious flaw in Liquids software allowed nearly its entire BTC reserve to be pulled out in one incident, forcing a full sidechain halt and freezing LBTC activity. The core Bitcoin network remains intact, but this exploit underlines how much risk can sit in federated bridges and sidechains that many users treat as infrastructure. The main signals from here are whether the patch is robust, how much of the 4,000 BTC is actually returned, and how exchanges and large holders reassess their reliance on these off-mainnet systems.
[^1]: Liquid Network pauses after purported white-hat hackers withdraw 320 million dollars in bitcoin [^2]: Bitcoin sidechain Liquid pauses after purported white hats withdraw 320M in BTC [^3]: Supposed white-hat hackers drain 320 million dollars in BTC from Liquid Network, say they will return it after fix [^4]: Blockstream hunts white hats after 4,000 BTC leaves Liquid
CoinsKid.Com