BTC sidechain halts after 4,000 BTC withdrawal

TLDR

Blockstreams Liquid Network, a Bitcoin (BTC) sidechain, has been paused after about 4,000 BTC was withdrawn from its federation wallet in a security incident.

1. Purported white-hat hackers exploited a bug and withdrew roughly 4,000 BTC, about 95 percent of Liquids reserves, prompting the network to halt operations.
2. Liquid Bitcoin (LBTC) deposits and withdrawals are suspended, bridge nodes are disabled, and the main impact is on LBTC users and Liquids peg, not on the Bitcoin base chain.
3. The key variables now are whether Blockstream patches the Elements bug cleanly, how fast nodes upgrade, and whether the hackers actually return the BTC as they claim.

Deep Dive

1. What Happened

Multiple reports say the Liquid Network paused after actors claiming to be white-hat hackers withdrew about 4,000 BTC, worth around 320 million dollars, from its federation wallet via the SideSwap peg-out service. The withdrawal appears to have represented roughly 95 percent of Liquids reported reserves, which dropped from about 4,200 BTC to just over 200 BTC afterwards.

Liquid and Blockstream say the withdrawal exploited a bug in the Elements software that underpins Liquid, rather than a compromise of keys, with the BTC routed through SideSwaps Peg-out Authorization Key (PAK). The attackers left an on-chain message identifying themselves as whitehats and asking Blockstream to fix the bug and patch every node before they return most of the funds, although security figures such as Ledgers CTO have publicly questioned whether this behavior is consistent with ethical disclosure, comparing it to incidents like Ronin and Euler.

2. Impact On Users And BTC

To contain the incident, Liquid disabled bridge nodes and paused network activity, meaning new transactions cannot be submitted and the sidechain is effectively frozen. Exchanges have suspended, or are preparing to suspend, deposits and withdrawals of LBTC, the token that represents BTC on Liquid, while other assets issued on Liquid such as USDT and certain real-world asset tokens are reported as unaffected.

Mainnet Bitcoin continues to function normally and spot BTC markets were reported as largely stable around the time of the incident. The immediate risk concentrates on users holding LBTC or relying on Liquid-based settlement flows, as the peg is now backed by a much smaller reserve plus the uncertain prospect of fund recovery.

3. What To Watch Next

Blockstream and Liquid federation members say they are working to fix the Elements bug, patch nodes, and coordinate a restart of the sidechain once they are confident the vulnerability is closed. The attackers, for their part, have indicated they intend to return most of the BTC only after they verify the fix and see all nodes patched, communicating via on-chain messages and encrypted channels.

Key milestones to watch include: an official technical post-mortem explaining the root cause, confirmation that Liquid has resumed processing with updated software, and on-chain movement of the ~4,000 BTC back to federation-controlled addresses or another agreed destination. Longer term, this incident feeds into the broader debate on how much trust users should place in federated sidechains and custodial bridges that concentrate control over large BTC reserves.

Conclusion

Liquids halt after the withdrawal of roughly 4,000 BTC highlights how bridge and sidechain vulnerabilities can drain almost all backing assets without touching the Bitcoin base protocol. The outcome now hinges on Blockstreams ability to patch Elements and coordinate a safe restart, and on whether the self-described white hats actually return the funds. For BTC users, the lesson is that wrapped or bridged representations like LBTC carry additional trust and governance risk on top of Bitcoins own security model.