Liquid Network, a Bitcoin sidechain used by crypto exchanges and trading firms, paused its network after roughly 4,000 BTC, worth about $320 million, were withdrawn from its federation wallet in an exploit.
The incident occurred on September 6 and affected about 95% of the roughly 4,200 BTC held in the wallet before the withdrawal.
Launched in 2018 by Blockstream, Liquid Network confirmed the incident through a post on X. The network also said that Blockstream, its technology provider, was working to contact the parties responsible.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet.
The alleged hackers left an on-chain message saying, “we are whitehats. Contact us on chain.” However, their claim that the withdrawal was a white-hat security operation has not been independently verified, and Liquid has not confirmed whether the hackers will return the funds.
What We Know About the Liquid Network Exploit
According to Liquid Network, Bitcoin was withdrawn through SideSwap’s Peg-out Authorization Key (PAK) system. The network also confirmed that the PAK itself was not compromised and that no other cryptographic keys were breached.
“What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others,” the network said in an X post.
CoinDesk reported that Blockstream later traced the L-BTC involved in the withdrawal to a bug in Elements, the open-source software platform underlying Liquid Network. The issue therefore appears to be different from a conventional private-key theft, although the full technical cause remains under investigation.
A federation of more than 80 exchanges, infrastructure firms, and asset managers oversees Liquid Network. It is a Bitcoin sidechain designed to provide faster, confidential settlement and support digital asset issuance.
BTC deposited into the system backs Liquid Bitcoin (L-BTC) on a one-to-one basis. This allows exchanges and traders to settle Bitcoin transactions faster and more privately. Liquid operates independently of Bitcoin, meaning the exploit did not compromise the Bitcoin blockchain.
The Hackers’ Message
White-hat hackers generally identify security vulnerabilities to help firms fix them. They typically exploit a flaw, move the money, and then seek a fee to return it.
The hackers are communicating with network maintainers through on-chain Bitcoin transactions and have said they will return the money once the vulnerability is fixed.
“Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix,” one message said.
(Hackers’ on-chain message to Liquid)
Liquid Network Paused Transactions
Following the breach, Liquid has temporarily disabled its bridge nodes to pause new transactions. Exchanges were notified to suspend L-BTC deposits and withdrawals while the investigation continues.
The network confirmed that other liquid assets, such as USDT, DePix, and RWAs, were not affected by the exploit.
Blockstream is attempting to communicate with the purported white-hat hackers on-chain. As of September 7, Liquid had not announced when normal network operations would resume or confirmed whether the hackers would return the withdrawn Bitcoin.
