BTC sidechain halts after $320M exploit

TLDR

A major security incident on the Liquid Network, a Bitcoin sidechain run by Blockstream, halted the chain after about 4,000 BTC (around $320 million) were withdrawn from its federation wallet.

1. Purported white-hat hackers exploited a software bug to mint L-BTC and withdraw roughly 95% of Liquids Bitcoin reserves, prompting Liquid to pause all bridge activity and new transactions.
2. The impact is concentrated on Liquid users, LBTC and related services, while Bitcoins main chain and price appear largely unaffected so far.
3. The key unknowns are whether the funds will actually be returned, how quickly the bug is patched and nodes updated, and what this means for trust in sidechains and bridges.

Deep Dive

1. What Happened On Liquid

Liquid Network, a federated Bitcoin sidechain used for faster, confidential transfers and issued assets, reported that actors claiming to be white-hat hackers withdrew about 4,000 BTC (roughly $320 million) from its federation wallet, almost 95% of its roughly 4,200 BTC reserves. The withdrawal was executed via SideSwaps Peg-out Authorization Key (PAK), but Liquid and SideSwap both say the PAK itself was not compromised and that the root issue is a bug in Elements, the open source software underpinning Liquid. In response, Liquid disabled bridge nodes and exchanges suspended deposits and withdrawals of Liquid Bitcoin (LBTC), effectively pausing the sidechain while Blockstream and federation members investigate and try to contact the attackers through signed on-chain messages, as reported by sources such as Cointelegraph.

2. Who Is Impacted And How

Liquid has said that LBTC deposits and withdrawals are paused and that Liquid wallets will be impacted, while other assets issued on Liquid, such as USDT, DePix and certain tokenized real world assets, are reportedly unaffected at the protocol level. Users of services built on Liquid, including the Aqua wallet, are seeing functionality issues related to the sidechain, although ordinary Bitcoin transfers remain operational, according to reporting from CryptoBriefing. Market coverage from outlets like Investing.com notes that Bitcoins spot price has been broadly driven by macro factors and ETF flows, with this exploit mainly raising infrastructure risk concerns rather than causing a sharp BTC selloff.

3. Return Of Funds And Sidechain Trust

The attackers left on-chain messages stating we are whitehats. contact us on chain and later indicated they might return most of the BTC once Liquid patches the vulnerability and updates every node, sharing encrypted technical details with Blockstream, as described by CryptoPotato. However, security experts including Ledgers CTO have publicly questioned whether this behavior is consistent with ethical disclosure, comparing it to prior bridge exploits on Ronin and Euler, and stressing that draining hundreds of millions to gain leverage is not standard white-hat practice. Until the bug is clearly fixed and funds demonstrably returned, trust in Liquids peg and in federated sidechains and bridges more broadly is likely to remain under pressure.

Conclusion

The Liquid exploit shows how a single software bug in a sidechain or bridge can endanger large pools of collateral even when Bitcoins base layer remains untouched. For crypto users, the episode reinforces that venue and infrastructure risk matters as much as asset risk, especially when using wrapped or pegged versions of major coins. Watching how quickly Blockstream and Liquid fix the vulnerability and whether the attackers honor their promise to return funds will be central to judging both Liquids future and broader confidence in Bitcoin-linked layer 2s.