Liquid Network has paused activity after approximately 4,000 BTC, worth around $320 million, was withdrawn from the federation wallet backing its Bitcoin sidechain. The security incident removed roughly 95% of the Bitcoin previously held in the federation wallet, prompting the network to disable new transaction submissions while Blockstream works with federation members to resolve the issue.
In an official Liquid Network announcement, the project said the parties responsible described themselves as white-hat hackers and that Blockstream had begun communicating with them through signed on-chain messages. Liquid said the withdrawal used SideSwap’s Peg-out Authorization Key pathway, but neither that PAK nor other federation keys were compromised. Reuters separately confirmed that roughly 4,000 of the wallet’s approximately 4,200 BTC had been withdrawn.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds…
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
Liquid Disables Bridge Nodes After Peg-Out
The incident involved approximately 4,000 LBTC entering SideSwap’s peg-out process, followed by the release of roughly 3,996 BTC on Bitcoin. Because the corresponding LBTC was burned as part of the peg-out, the incident does not automatically mean the remaining circulating LBTC became fractionally backed, even though the federation’s absolute Bitcoin reserves fell dramatically.
Liquid responded by disabling its bridge nodes, effectively preventing new transactions from being submitted to the sidechain. Exchanges were also notified to suspend LBTC deposits and withdrawals. The operational freeze is intended to prevent additional activity while developers identify and patch the underlying vulnerability, leaving normal bridge functionality unavailable until the network is considered safe.
Liquid said other issued assets, including USDT, DePix and tokenized real-world assets, were not directly affected by the withdrawal. The immediate security event centered on Liquid’s Bitcoin peg-out infrastructure rather than a confirmed compromise of every asset issued on the sidechain, although the network-wide pause still affects users’ ability to transact normally.
Purported White Hats Signal Fund Return
On-chain communications added an unusual dimension to the incident. The parties controlling the withdrawn Bitcoin identified themselves as white hats and reportedly provided Blockstream with encrypted technical information about the vulnerability. They indicated that most of the funds would be returned after the relevant software was patched across the network, but their characterization of themselves as security researchers has not been independently established.
Blockstream subsequently communicated through signed messages that bridge nodes had been patched and that the funds could be returned. Approximately 3,998.5 BTC nevertheless remained unmoved in the destination wallets in the latest available updates, leaving recovery dependent on the parties following through on their stated intention.
The incident highlights the security trade-offs inherent in Liquid’s federated two-way peg. Official Liquid documentation explains that peg-outs require authorization through the PAK system and that federation functionaries control the Bitcoin released against burned LBTC. A failure capable of producing an authorized-looking peg-out without compromised keys raises questions about the software and validation logic surrounding that process, rather than pointing to a breach of Bitcoin itself.
Liquid remains focused on restoring safe operations and recovering the withdrawn Bitcoin. The decisive next milestones are the return of the funds, confirmation of the underlying vulnerability and a secure reopening of bridge activity, all of which will determine the lasting impact of one of the largest security incidents involving a Bitcoin sidechain.