A group calling itself white-hat hackers withdrew about $320 million in bitcoin from the Liquid Network on Saturday, forcing the sidechain to pause operations as its federation scrambles to respond.
The Block reported the halt on September 6, 2026. Liquid went offline shortly after the withdrawal was spotted, and no official explanation has come from Blockstream or the federation members yet. The network is a sidechain pegged to bitcoin, one of the longest-running scaling experiments in the bitcoin ecosystem, and a halt of this kind is rare.
What Happened
Liquid is a bitcoin sidechain operated by a federation of functionaries rather than a single company. The network holds pegged bitcoin, called L-BTC, that users can move between the main bitcoin chain and Liquid through peg mechanics controlled by the federation. Exchanges and traders use it for faster settlement, confidential transactions, and issued assets that would otherwise clog the base layer.
The withdrawn sum, roughly $320 million, was moved out in a coordinated action the perpetrators describe as a white-hat intervention. That framing matters. A genuine white-hat action would typically mean the funds were taken to prevent a worse exploit, with an intention to return them. Without a verified statement from the group and no confirmation from federation members, the classification remains open. The alternative reading is straightforward theft with a convenient label attached, which has happened before in this industry.
The pause itself appears to be an emergency control rather than a failure of the halt mechanism. Liquid’s federation can stop peg movements when members detect abnormal activity, and the speed of the response suggests the watchdog systems did their job even if the withdrawal went through.
The Federation Question
Liquid’s security model depends on a group of key holders spread across exchanges and infrastructure companies. The design assumes no small coalition can move pegged funds unilaterally. A withdrawal of this size, executed fast enough to trigger a network pause, raises the question of whether the threshold was genuinely met, was bypassed, or whether emergency procedures were invoked legitimately under duress. Each answer points to a different post-mortem.
This is not the first security scare for the network. Liquid has faced scrutiny before, including a 2021 incident in which an attacker claimed to have accessed federation key material, which Blockstream disputed. Each event puts the same tension on display: a federated model trades full trustlessness for throughput and faster finality, and that trade shows its cost exactly during incidents like this one. Critics of federated sidechains have argued for years that the model concentrates risk in a way that pure bitcoin custody does not.
Funds and Market Impact
No comparable theft has been confirmed. If the actors return the funds, the event lands closer to a stress test than a loss. If they do not, roughly $320 million in pegged bitcoin sits in disputed hands, and L-BTC holders face a redemption process running through the federation while the chain stays down. Issued assets on Liquid, including tokenized securities and stablecoins used by some regional exchanges, are also frozen until the network restarts.
Bitcoin’s own price was little affected over the weekend, trading in a tight range between $78,500 and $80,500 according to CoinDesk data. Liquid is a niche venue compared with main-chain activity, and most large traders keep exposure on exchanges or the base layer, so contagion into broader markets was limited. The total value locked on Liquid sits far below bitcoin ETF holdings, which crossed $55 billion in cumulative flows this year.
What Comes Next
The immediate steps are familiar from past incidents. Federation members will verify the withdrawal path, publish a post-mortem, and decide on a restart procedure. If the funds came out through a legitimate emergency threshold, the pause is the system working as designed. If they did not, the episode becomes the most serious operational failure in the sidechain’s history and will feed the argument that federated models belong in the past.
Users holding L-BTC or assets issued on Liquid have no independent way to exit while the chain is halted. Watch for a statement from Blockstream and the federation operators before drawing conclusions either way. The next credible update is likely to come through member exchanges, several of which operate peg functionary nodes and face pressure to explain their own role.
discussion