Liquid Network Faces $320M Bitcoin Drain and a White-Hat Claim
Liquid Network has halted activity after nearly 4,000 BTC worth about $320 million left the federation wallet backing L-BTC on September 6.
Summary:
- Nearly 4,000 BTC worth about $320 million left Liquid’s federation reserve.
- SideSwap says its peg-out authorization key was used legitimately and was not compromised.
- Investigators are examining whether an Elements software bug created unbacked L-BTC.
- Liquid remains paused while Blockstream investigates and communicates with the self-described white hats.
The withdrawal removed roughly 95% of the Bitcoin reserve, but the funds have remained largely unmoved while the unidentified actors claim to be white-hat hackers. Blockstream and federation members are investigating whether a vulnerability in Elements, the software underlying Liquid, allowed additional L-BTC to be created and redeemed for genuine Bitcoin.
A Valid Redemption Exposed a Much Deeper Problem
The incident began at around 14:05 UTC on September 6, when 4,000 L-BTC was submitted to SideSwap’s peg-out service.
Normally, L-BTC represents Bitcoin locked within Liquid’s federation-controlled reserves. When a holder exits Liquid, the L-BTC is burned and the corresponding BTC is released on the Bitcoin network.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds…
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
SideSwap said its system treated the request as legitimate. The L-BTC was burned through the normal process, and approximately 3,996 BTC was subsequently released to the requested Bitcoin address.
Only afterward did the central problem become apparent.
According to SideSwap, Blockstream’s investigation indicated that the L-BTC used in the redemption had been created through a possible bug in Elements, rather than being backed by Bitcoin previously deposited into the federation.
If confirmed, the exploit would have targeted the accounting relationship between BTC and L-BTC rather than simply stealing the keys protecting the federation wallet.
That distinction is critical because the peg-out itself appears to have worked as designed. The system may instead have been presented with tokens that should never have existed.
The Federation Keys May Not Be the Point of Failure
Liquid’s architecture relies on a federation rather than a conventional single-operator bridge. Blockstream documentation describes the main Bitcoin custody arrangement as an 11-of-15 multisignature system.
SideSwap also said its Peg-out Authorization Key (PAK) was not compromised.
The emerging theory therefore looks different from a conventional bridge hack in which attackers steal enough private keys to directly move reserves.
Instead:
- Extra L-BTC may have been created through a vulnerability in Elements.
- The tokens reached SideSwap’s peg-out service and appeared valid for redemption.
- The normal authorization process succeeded, without evidence that the PAK itself had been stolen.
- Real BTC was released against L-BTC that may not have had corresponding Bitcoin backing.
Blockstream has not yet published a full technical post-mortem, so the exact vulnerability and its scope remain under investigation.
That uncertainty matters. Developers need to determine not only how the apparent invalid L-BTC was created, but whether any additional unbacked supply could exist elsewhere on the network.
The Bitcoin Has Not Been Cashed Out
The behavior after the withdrawal has been unusual for an exploit of this size.
The unidentified party embedded an onchain message stating:
“we are whitehats. contact us on chain.”
Blockstream subsequently opened communication with the actors through blockchain messages. Reports also indicate that the party asked whether returning most of the Bitcoin to the federation would be acceptable.
The funds have not been dispersed through the type of complex transaction trail commonly seen when attackers attempt to launder stolen crypto.
READ MORE: Crypto Security Under Pressure: Three Incidents Raise New Risks
That supports the possibility of a negotiated return, but the white-hat label remains self-declared. Withdrawing reserve assets before disclosure does not by itself establish responsible security research, and no agreement on returning the funds has been publicly confirmed.
For Liquid users, the next movement from the receiving address could therefore be more consequential than the attacker’s description of its intentions.
Liquid Stays Offline While Blockstream Checks the Damage
Liquid responded by disabling bridge nodes and effectively pausing the sidechain while federation members investigate.
Exchanges and other service providers have been asked to suspend L-BTC deposits and withdrawals until the network can safely resume operations.
Liquid says other assets issued on the network, including USDT, DePix and tokenized real-world assets, were not directly affected.
Their ability to move is nevertheless disrupted while the network remains paused.
The incident also does not represent a compromise of Bitcoin itself. Liquid is a federated Bitcoin sidechain built using Blockstream’s Elements software. Bitcoin’s base-layer consensus and normal BTC transactions continue independently.
Restoring the network requires more than recovering the withdrawn coins. Blockstream and federation members need to establish whether the suspected Elements flaw can be reproduced, determine the extent of any invalid L-BTC issuance and ensure that the backing relationship can be trusted before reopening the bridge.
L-BTC’s Backing Is Now the Central Question
Liquid’s model depends on L-BTC maintaining a verifiable relationship with Bitcoin held by the federation.
The incident challenges that assumption at the issuance layer.
A stolen federation key would be serious but relatively straightforward to diagnose: an unauthorized party gains control over legitimate reserves. A flaw capable of creating additional L-BTC presents a different problem because the reserve can remain cryptographically protected while its liabilities quietly become larger than the Bitcoin backing them.
That is why the eventual technical report will matter beyond whether the current BTC is returned.
Blockstream will need to show how the anomalous L-BTC entered circulation, whether the vulnerability affected other transactions and what changes prevent the same path from being used again. Until those questions are answered, restarting the network would restore transaction processing without fully resolving the confidence problem exposed by the incident.
The immediate outcome now rests on two separate tracks: negotiations over the Bitcoin and the technical investigation into Elements.
A successful return could prevent the incident from becoming a permanent nine-figure loss, but only a verified fix and accounting of L-BTC supply can address the vulnerability that allowed the withdrawal to happen in the first place.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Zdravkov
Reporter at CoinsPress
Alexander Zdravkov is a market analyst and crypto journalist with interests in economics, broader financial markets and digital assets. His journey into crypto began more than four years ago, driven by a fascination with the rapid evolution of blockchain technology and the transformative potential of decentralized finance. He began analyzing market cycles and identifying emerging trends before they reach the mainstream. He holds a degree in International Relations - a background that helped shape his broader perspective on global economics, geopolitics, and the interconnected nature of modern financial markets. Whether covering the latest developments in the crypto sector or exploring broader macroeconomic themes, Alexander focuses on giving readers context rather than simply repeating headlines. During his career, he has authored more than 10,000 articles covering cryptocurrencies, traditional finance, and global market developments. His work spans everything from Bitcoin and altcoins to macroeconomic trends influencing risk assets worldwide.
