Liquid Network has paused activity on its Bitcoin sidechain after purported white-hat hackers withdrew about 4,000 bitcoin, valued at roughly $320 million, from the network’s federation wallet, according to a statement issued by the project.
The incident, disclosed on Sept. 6, accounted for about 95% of Liquid’s reported Bitcoin reserves. The network had approximately 4,200 BTC in its reserves before the withdrawal, making the incident one of the most significant security events to affect the Bitcoin sidechain.
Liquid said the withdrawal forced it to temporarily halt network operations while federation members investigate the incident and work toward resolving the security issue.
Liquid’s technology provider, Blockstream, was attempting to establish contact with the parties responsible through a signed message recorded on the Bitcoin blockchain. The network described the individuals as purported white-hat hackers but did not disclose their identities or confirm whether the withdrawn Bitcoin would be returned.
Peg-Out Authorization Key Used in Withdrawal
Liquid said the funds were withdrawn through the SideSwap Peg-out Authorization Key, commonly known as the SideSwap PAK. The network stated that the key itself had not been compromised and said there was no indication that other keys had been breached.
However, Liquid did not disclose the underlying vulnerability that enabled the large withdrawal. The lack of details leaves questions about how the transaction was authorized and whether additional safeguards may be required before the network can resume normal operations.
An on-chain message included in a Bitcoin transaction associated with the incident indicated that the individuals behind the withdrawal identified themselves as white-hat hackers and requested that Liquid contact them through the blockchain.
Liquid has notified cryptocurrency exchanges about the incident. Some exchanges have suspended deposits and withdrawals involving LBTC, the Bitcoin-backed token issued on the sidechain, while others were expected to implement similar restrictions.
The network also temporarily disabled its bridge nodes, preventing users from submitting new transactions. The suspension effectively leaves the Liquid sidechain paused until the security incident is resolved, limiting users’ ability to move assets through the network.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds…
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
Other Liquid Assets Reportedly Unaffected
Despite the scale of the Bitcoin withdrawal, Liquid said other assets issued on the network were not affected by the incident. These included USDT, DePix and various real-world assets.
The network nevertheless warned that the disruption would affect wallets and users attempting to interact with Liquid while bridge infrastructure remains disabled. The temporary restrictions are expected to remain in place until federation members determine that network operations can safely resume.
Liquid is a Bitcoin sidechain designed to enable faster and more confidential transactions while supporting the issuance of digital assets. Bitcoin deposited into the underlying Bitcoin network is represented on Liquid through LBTC, with federation members responsible for safeguarding the Bitcoin backing those tokens.
The federation plays a central role in Liquid’s security model because its members oversee the Bitcoin held to support the sidechain’s assets. The withdrawal of such a large portion of those reserves therefore creates significant operational and security concerns for the network.
Liquid said federation members were working to address the incident and restore normal activity. The project has not provided a specific timeline for restarting the sidechain or disclosed further details about its communication with the purported white-hat hackers.
The incident is likely to keep attention focused on the security of Bitcoin sidechains and the mechanisms used to authorize withdrawals from federated wallets. The outcome of Liquid’s investigation, including whether the withdrawn Bitcoin is recovered and how the vulnerability is addressed, will be central to determining when normal operations can resume.
