Liquid Network Pauses Bitcoin Sidechain After Purported White Hats Drain Roughly 4,000 BTC
The Liquid Network paused its Bitcoin sidechain on September 6, 2026, after purported white-hat hackers withdrew approximately 4,000 BTC, worth roughly $320 million, from the network's federation reserve wallet. The withdrawal left the wallet with roughly 200 BTC, emptying approximately 95% of the pegged bitcoin backing the network, which previously held roughly 4,200 BTC. The actors controlling the funds identified themselves on-chain as whitehats and conditioned the return of most of the money on the underlying vulnerability being patched across all nodes.
In a public statement reported by Decrypt, the Liquid Network said: "We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message."
Key takeaways
- Approximately 4,000 BTC worth roughly $320 million left the Liquid federation reserve wallet on September 6, 2026, leaving roughly 200 BTC behind.
- The withdrawal was routed through SideSwap's Peg-out Authorization Key (PAK), but neither SideSwap's key nor any other federation keys were compromised.
- SideSwap stated the L-BTC used in the withdrawal was created through a bug in Elements, the open-source software running Liquid.
- Liquid paused sidechain operations and disabled bridge nodes, while exchanges suspended L-BTC deposits and withdrawals.
- Other assets on Liquid, including USDT, DePix, and tokenized real-world assets, as well as the main Bitcoin network, were unaffected by the incident.
How the funds left the network
The withdrawal was routed through SideSwap's Peg-out Authorization Key (PAK), but neither SideSwap's key nor any other federation keys were compromised, according to reporting from Cointelegraph and Decrypt. SideSwap stated that the L-BTC used in the withdrawal was created through a bug in Elements, the open-source software running Liquid, as reported by Unchained.
In response, Liquid paused sidechain operations and temporarily disabled its bridge nodes to prevent new transactions, while exchanges suspended L-BTC deposits and withdrawals, per The Block. "Effectively, the Liquid sidechain is paused until this issue is resolved," the Liquid Network said.
Researchers point to a cache-key collision in Elements
Researchers Calle and Charles Guillemet detailed that a cache-key collision allowed invalid transactions to bypass Liquid's range-proof verification checks and mathematically balance unbacked L-BTC outputs, according to CryptoSlate. A transaction reconstruction by Stu, cited in the same report, identified setup transactions followed by an allegedly invalid transaction at Liquid block 4,050,336 that created approximately 3,996.0183 L-BTC.
Mononaut reported that the bug had entered the Elements master development branch but had not appeared in a tagged release, leading federation functionaries to accept the exploit while external nodes powering mempool's Liquid explorer rejected the affected block, per CryptoSlate.
An on-chain negotiation, and white-hat skepticism
A message embedded on-chain by the party controlling the funds read, "we are whitehats. contact us on chain." as reported by Decrypt. The actors conditioned returning most of the funds on the underlying vulnerability being patched across all nodes, according to Cointelegraph.
Not everyone accepts that characterization. Ledger CTO Charles Guillemet pushed back on the label, saying, "White hats don't drain a bridge and then solicit an 'on-chain' contact," per Decrypt.
What was not affected
Other assets issued on the Liquid Network, including USDT, DePix, and tokenized real-world assets, were unaffected by the incident, and the main Bitcoin network was also unaffected, according to Finance Magnates and NewsBTC.
Frequently asked questions
Was the main Bitcoin network affected?
No. The incident was contained to the Liquid sidechain; the main Bitcoin network was unaffected, per NewsBTC.
Were Liquid's federation keys compromised?
No. The withdrawal was routed through SideSwap's Peg-out Authorization Key, but neither that key nor any other federation keys were compromised, according to Decrypt. SideSwap attributed the withdrawn L-BTC to a bug in the Elements software.
Will the funds be returned?
The actors controlling the funds said they would return most of them once the vulnerability is patched across all nodes, per Cointelegraph. The Blockstream team has been working to contact them on-chain with a signed message, and the sidechain is paused until the issue is resolved, per The Block.