BTC sidechain halts after $320M whitehat drain

TLDR

A major Bitcoin sidechain, Liquid Network, has paused after actors calling themselves white-hat hackers withdrew about 4,000 BTC worth roughly $320 million from its federation wallet.

1. Liquid halted bridge nodes and new transactions after ~4,000 BTC, around 95% of its reserves, were withdrawn via a bug in its Elements software and redeemed through the SideSwap peg-out service.
2. Liquid Bitcoin (LBTC) is now reportedly backed by only a small fraction of the BTC required, and exchanges have suspended LBTC deposits and withdrawals while other Liquid assets are frozen in place.
3. The hackers say they will return most funds once the bug is fixed and every node is patched, but skepticism remains, making the timeline and ultimate loss distribution uncertain.

Deep Dive

1. What Happened On Liquid

Liquid Network, a Bitcoin sidechain operated by Blockstream, reported that about 4,000 BTC, roughly $320 million, were withdrawn from its federation wallet on 6 September via SideSwaps peg out authorization key PAK, exploiting a bug in the Elements software that underpins Liquid. Multiple reports note that roughly 3,996 BTC were paid out after 4,000 L BTC entered SideSwaps peg out service, even though those L BTC were effectively created by the bug rather than backed by real BTC.

Liquid disabled bridge nodes and paused the sidechain, while its technology provider Blockstream began contacting the attackers through signed on chain messages and public posts, after the attackers wrote on chain that we are whitehats. contact us on chain.

2. Impact On LBTC And Users

Because roughly 4,000 of about 4,200 BTC were withdrawn from the federation wallet, coverage for LBTC reportedly dropped to about 4.7 percent of the BTC needed to keep a 1 to 1 peg, with only around 197 BTC left backing the supply. Exchanges have suspended or are preparing to suspend LBTC deposits and withdrawals, and Liquid has said wallets will be impacted while bridge nodes are down, even though other Liquid issued assets like USDT and tokenized real world assets were not directly exploited.

Bitcoin itself continues to function normally, but anyone holding LBTC or relying on Liquid based wallets and services faces peg uncertainty and illiquidity until the network is restarted and a plan for any shortfall is clarified.

3. Hackers Claims And What To Watch

The attackers claim to be white hats and have said they will return the money back safely once Blockstream fixes the bug and ensures all nodes are patched, and they have already shared encrypted technical details about the vulnerability. Security experts, including Ledgers CTO, have publicly questioned the white hat framing, since draining almost an entire bridge reserve is not standard for responsible disclosure.

Key open questions are whether all or only most BTC will be returned, how and when LBTC peg outs will resume, and who will absorb any remaining deficit if the backing pool is not fully restored.

Conclusion

Liquids pause after a $320 million drain highlights how a single implementation bug in a federated sidechain can inflate assets and empty a bridge, even without any mainnet key compromise. For Bitcoin holders this is primarily a warning about wrapped and bridged representations like LBTC, where trust in the software and operators backing the peg is as critical as the underlying BTC itself. Until Liquids bug is patched, nodes are updated, and there is clear evidence of BTC returning, LBTC and other Liquid dependent positions carry elevated peg and liquidity risk.