On Sunday, Liquid Network announced that alleged white-hat hackers removed around 4,000 bitcoin, valued at approximately $320 million, from its federation wallet, which led the Bitcoin sidechain to suspend operations.
Via a Sept. 6 post on X, Liquid reported that Blockstream, its technology developer, was attempting to reach out to the individuals involved via an onchain signed message. The announcement failed to name them or verify if the assets would be sent back.
This extraction accounted for about 95% of Liquid’s listed bitcoin holdings, which totaled roughly 4,200 BTC prior to the event.
“We are aware of a security incident on @Liquid_BTC,” the network stated.
As stated by Liquid, the assets were removed via the SideSwap PAK, or Peg-out Authorization Key. The network stated that this key remained uncompromised, as did all other keys. Liquid omitted any explanation of the underlying flaw that enabled the removal.
An onchain message found within a bitcoin transaction connected to the event stated: “we are whitehats. contact us on chain.”
Liquid stated it had alerted digital asset exchanges, which either have halted deposits and withdrawals for LBTC, Liquid’s Bitcoin-pegged asset, or are planning to do so. Liquid additionally shut down bridge nodes temporarily, stopping new transactions from being processed on the network.
“Effectively, the Liquid sidechain is paused until this issue is resolved,” the announcement noted.
Additional tokens created on Liquid, such as USDT, DePix, and real-world assets, remained secure from the security breach, based on statements from the network. Nevertheless, Liquid cautioned that user wallets would experience disruption.
Liquid serves as a Bitcoin sidechain built for quicker, private transactions and the creation of tokens. BTC held on the main Bitcoin chain is mirrored as LBTC on Liquid, where federation members manage the security of the underlying bitcoin.
The network noted that federation participants were collaborating to fix the situation and bring back standard operations. Liquid refrained from stating an estimated timeframe for restarting the network or specifics regarding communications with the supposed white-hat hackers.
This is a developing story.
Originally published at https://www.theblock.co/news/defi/2026-09-06-liquid-network-pauses-after-purported-white-hat-hackers-withdraw-320-million-in-bitcoin-413626.
