Liquid Network pauses after 4,000 BTC withdrawal

TLDR

Liquid Network, a Bitcoin sidechain, has paused after actors claiming to be white-hat hackers withdrew around 4,000 BTC from its reserve wallet by exploiting a software bug.

1. Roughly 4,000 BTC (about 95% of reserves) were withdrawn from the Liquid Federation wallet via the peg-out mechanism, prompting Liquid to halt bridge activity and new transactions.
2. The incident puts the 1:1 L-BTC to BTC peg and confidence in Liquids federated bridge design under scrutiny, even though other assets like USDT on Liquid were not directly drained.
3. The hackers say they may return most funds after a fix, so the key things to watch are a confirmed patch, onchain evidence of BTC returning, and a detailed post-mortem on the vulnerability.

Deep Dive

1. How 4,000 BTC Left Liquid

Reports say about 4,000 BTC, worth roughly 320 million dollars, were withdrawn from the Liquid Federation wallet, representing nearly 95% of Liquids reported Bitcoin reserves before the incident. Liquid stated that the withdrawal went through the SideSwap Peg-out Authorization Key (PAK) as a seemingly valid peg-out, but that the key itself was not compromised and that the real issue was a bug in the Elements software that underpins Liquids L-BTC issuance and redemption process, allowing unbacked L-BTC to be created and redeemed for real BTC.

In response, Liquid disabled bridge nodes and paused new transactions, and exchanges halted or prepared to halt deposits and withdrawals of Liquid Bitcoin (L-BTC), as described in coverage of the pause and withdrawal in this incident report. Blockstream is communicating with the actors via signed onchain messages, while the BTC remains under their control for now.

2. Risks For L-BTC Users And Sidechains

Liquid is designed so that each L-BTC should be backed 1:1 by BTC in the federation wallet, but draining almost the entire reserve via the peg-out path places that peg under heavy scrutiny, as discussed in an analysis of the reserve loss and peg stress in this breakdown of the Liquid reserve impact.

Liquid says other assets on the sidechain, such as USDT, DePix and tokenized real-world assets, were not directly affected by the bug, but their transfers are interrupted because bridge nodes are offline. Wallets and apps that rely on Liquid, such as Aquas Liquid features, are also experiencing degraded functionality, even though regular Bitcoin mainnet transactions are unaffected.

3. What To Watch Next

The actors have claimed to be white-hat hackers and have indicated they may return most of the BTC once Liquid and Blockstream fix the vulnerability and ensure all nodes are patched, as summarized in follow-up reporting on the attackers onchain messages and Blockstreams replies in this update on the promised fund return.

Key confirmation steps to watch are: a public technical post-mortem explaining the bug, a clear statement that all bridge nodes are patched and back online, and onchain movement showing funds returning to federation-controlled wallets. Longer term, observers will be watching whether Liquid changes its bridge design or governance, and how this incident influences trust in other pegged Bitcoin systems and sidechains that rely on similar bridge-style mechanisms.

Conclusion

Liquids pause after a roughly 4,000 BTC withdrawal highlights that the main risk for many Bitcoin Layer 2s and bridges is not the base chain, but the software and governance around the peg. Until Liquid demonstrates a robust fix and visible reserve restoration, the episode serves as a reminder that wrapped or pegged assets carry additional trust and implementation risk compared with holding native BTC on the main chain.