BTC sidechain halts after $320M whitehat drain

TLDR

Blockstream's Liquid Network, a Bitcoin sidechain, has paused after actors claiming to be white-hat hackers drained about 4,000 BTC (around 320 million dollars) from its federation wallet.

1. Purported white hats exploited a bug in Liquids Elements software to create unbacked L-BTC and then withdraw roughly 4,000 BTC through peg-out infrastructure, prompting Liquid to halt the sidechain.
2. L-BTC backing has collapsed to a few percent of what is needed for the 1:1 peg, exchanges have frozen L-BTC, and all Liquid bridge activity is paused, although other Liquid assets were not directly stolen.
3. The big unknowns are whether the BTC will actually be returned, how quickly Liquid can safely patch and restart, and who absorbs any shortfall if funds are not fully restored.

Deep Dive

1. What Actually Happened

Liquid Network, a federated Bitcoin sidechain run with Blockstream technology, reported that about 4,000 BTC (around 320 million dollars) left its federation wallet in one incident, representing roughly 95 percent of its reserves. Multiple reports say the withdrawal went through SideSwaps peg-out service using its Peg-out Authorization Key, but neither that key nor other federation keys were compromised, pointing instead to a bug in the Elements software underpinning Liquids consensus and accounting logic.

The attackers used the bug to create L-BTC that was not backed by real Bitcoin, then redeemed that L-BTC via a normal-looking peg-out that paid real BTC from the federation wallet, according to detailed coverage of the 4,000 BTC withdrawal. After the exploit was detected, Liquid disabled bridge nodes, stopping new transactions, and exchanges halted L-BTC deposits and withdrawals while Blockstream began communicating with the attackers via signed on-chain messages.

2. Impact On L-BTC And Users

The drain leaves L-BTC effectively undercollateralized. One analysis notes that only about 197 BTC now back L-BTC, or roughly 4.7 percent of what is required for a full 1:1 peg, raising serious solvency questions for anyone holding L-BTC if funds do not return in full. A separate report highlights that Liquid Network is paused, exchanges have suspended L-BTC flows, and other assets issued on Liquid like USDT and tokenized real-world assets were not stolen but are effectively frozen while the sidechain is stopped.

The attackers claim to be white hats and have stated on-chain that they will return most or the money back safely once Liquid patches the bug and every node is updated, as summarized in post-incident commentary. However, some security experts, including Ledgers CTO, have publicly questioned whether this behavior matches normal white-hat practice.

3. What To Watch Next

There are three critical next steps. First, whether the attackers actually return the BTC, and whether it is all or only most of it, will determine if L-BTC can resume with full backing or if there is a permanent hole. Second, Liquid and Blockstream need to fully patch the Elements bug and coordinate a safe node upgrade before restarting bridge nodes, which may take time given the federated nature of the network.

Third, even if the funds return, community and institutional trust in Liquid and similar bridges and sidechains is likely weakened. Observers are already comparing the situation to prior bridge exploits, and the incident feeds a broader narrative that custodial or federated bridges remain a systemic weak point.

Conclusion

Liquid Networks pause after a 4,000 BTC exploit shows how a single software bug in sidechain infrastructure can abruptly turn fully backed wrapped Bitcoin into an undercollateralized asset with frozen liquidity. Whether the self-described white hats actually return the BTC, and how transparently Liquid handles the post-mortem and patch process, will shape not only L-BTCs future but also market confidence in Bitcoin sidechains and bridges more broadly.