Unknown actors pulled roughly 4,000 bitcoin from Blockstream’s Liquid Network federation reserve on Sept. 6. The withdrawal drained about 95% of the sidechain’s reported holdings and forced a network-wide pause.
The transaction moved approximately 4,000 BTC, near $320 million, from a federation wallet that held about 4,200 BTC before the incident, according to Liquid. Bridge nodes went down immediately after. New transactions were blocked. “Effectively, the Liquid sidechain is paused until this issue is resolved,” Liquid said in a statement.
Liquid is a federated Bitcoin sidechain. A group of functionaries collectively custodies the bitcoin locked on the main chain. BTC locked on Bitcoin is issued as L-BTC on Liquid, and the federation’s multisig arrangement is the trust backbone for every token in circulation. Under normal peg-out mechanics, an L-BTC burn on the sidechain precedes any bitcoin withdrawal. The transaction requires 11-of-15 multisig authorization with funds routed to an approved whitelist.
The funds were withdrawn through the SideSwap Peg-out Authorization Key, or PAK. Liquid stated that the PAK was not compromised. Nor were any other keys. The network did not explain what vulnerability allowed the withdrawal in the first place. SideSwap, whose infrastructure was used to route the transaction, posted that its key was not compromised and that the L-BTC involved was “created through a bug in the Elements software,” the open-source codebase Liquid runs on.
That detail puts two possibilities on the table. Either enough functionaries signed off on the withdrawal to meet the 11-of-15 threshold, or the whitelist designed to prevent unauthorized peg-outs failed to hold. “Either 11 of 15 functionaries signed this off, or the whitelist built to prevent exactly this didn’t hold,” DBCrypto, a crypto analyst, wrote on X. “Neither answer makes Liquid look good.”
On Liquid’s public explorer, the federation wallet’s balance dropped from roughly 4,200 BTC to 207.275 BTC following the incident.
An onchain message embedded in a bitcoin transaction linked to the withdrawal read: “we are whitehats. contact us on chain.” That unverified OP_RETURN message is the only basis for the whitehat characterization. No independent confirmation of the actors’ motives or identity has surfaced. Blockstream, the network’s technology provider, was working to contact the responsible parties through an onchain signed message, according to Liquid. The statement did not identify them or confirm whether funds would be returned.
DBCrypto noted the withdrawn bitcoin had not been mixed and was sitting unmoved on Bitcoin. That, he said, was “more consistent with a whitehat extraction than a theft.” The funds had not moved at time of writing.
Exchanges were notified and have either suspended L-BTC deposits and withdrawals or were expected to do so. Other assets issued on Liquid, including USDT, DePix, and tokenized real-world assets, were unaffected. Liquid warned, however, that wallets would be impacted by the pause.
Samson Mow, CEO of Jan3 and a longtime Liquid advocate, wrote on X: “Everyone is actively working to resolve this…These are difficult times but we’ll pull through.”
At time of writing, Blockstream and CEO Adam Back had not publicly posted about the incident. Liquid has not disclosed when it plans to restart the network.
The incident exposes the custody architecture underpinning federated Bitcoin sidechains and the wrapped-BTC products that depend on them. L-BTC circulates across exchanges and DeFi protocols on the strength of the federation’s multisig commitments. If the withdrawal exploited a software bug rather than a key compromise, the failure sits in the protocol layer itself: the mechanism that governs how locked bitcoin is released. That is a different problem than a stolen private key, and harder to fix with a rotation.
The root vulnerability remains undisclosed. The identity of the actors is unknown. Whether the funds come back is unknown. What is known: 4,000 BTC left the federation reserve, the sidechain is dark, and the explanation so far is an unsigned message on the blockchain.
