Image Credit: Shutterstock
Liquid Network, a Bitcoin sidechain used by crypto exchanges and financial firms, paused transactions after roughly 4,000 BTC worth about $320 million was withdrawn from its federation wallet. The unidentified actors described themselves as white-hat hackers and reportedly said they would return the funds after the underlying vulnerability is fixed.
Liquid Halts Network After 4,000 BTC Withdrawal
Liquid confirmed the security incident on Sept. 6, saying around 4,000 of the roughly 4,200 BTC held in its federation wallet had been withdrawn. The network temporarily disabled its bridge nodes, preventing new transactions from being submitted.
Exchanges were told to pause L-BTC deposits and withdrawals while federation members investigated the incident. Liquid said other assets on the sidechain, including USDT, DePix and tokenized real-world assets, were not affected by the incident.
The incident did not affect the Bitcoin base network. Liquid operates as a separate Bitcoin sidechain with its own federation, while L-BTC is designed to represent Bitcoin on the network at a 1:1 ratio.
SideSwap Says Its Authorization Key Was Not Compromised
The withdrawal passed through SideSwap, which provides peg-in and peg-out services between Bitcoin and Liquid. Liquid said the transaction used SideSwap’s Peg-out Authorization Key, but neither that key nor other authorization keys had been compromised.
SideSwap said a customer sent 4,000 L-BTC to its peg-out service at 14:05 UTC. The federation paid approximately 3,996 BTC to the customer’s Bitcoin address at 14:28 UTC after the L-BTC was burned with valid authorization.
SideSwap said Blockstream later determined that the affected L-BTC originated from a vulnerability in Elements, the open-source software underlying Liquid. The company said its own systems could not distinguish those tokens from ordinary L-BTC.
Actors Claim They Are White Hats
A Bitcoin transaction associated with the funds carried an onchain message stating that we are whitehats, contact us on chain. Blockstream began communicating with the actors through signed onchain messages, but their claimed white-hat status has not been independently established.
In subsequent messages, the actors reportedly told Blockstream to patch the vulnerability across the network before they returned the Bitcoin. They reportedly said the funds would be transferred back after the fix was deployed.
Liquid Remains Paused During Security Work
Liquid’s official documentation describes the network as infrastructure for exchanges and financial institutions, with members including Bitfinex, BitMEX, BTSE and BtcTurk. The federation secures the Bitcoin backing L-BTC while Liquid provides faster settlement and digital-asset issuance.
The network had not announced a confirmed restart time in its initial incident update. Federation members were continuing work on the vulnerability and the conditions required to safely resume transactions.
