Roughly 4,000 bitcoin, worth about $320 million, left the Liquid Network federation wallet on Saturday, and the Blockstream-run sidechain has halted new transactions while it works out what happened.
The wallet that backs LBTC held 4,200 BTC before the withdrawal. The Liquid explorer now shows 207.275 BTC left. A message embedded in the transaction data read “we are whitehats. contact us on chain,” and the coins have sat in a fresh address since, unmoved.
Liquid confirmed the halt on X: “Liquid wallets will be impacted, and we’re sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.” Member exchanges were told to pause LBTC deposits and withdrawals until further notice, and the network stopped processing new transactions entirely. The company has not given a timeline for reopening.
How the funds moved
Peg-outs on Liquid normally need signatures from 11 of 15 functionaries plus a Peg-out Authorization Key, a second layer built to limit damage if functionary hardware is ever compromised. Liquid said the withdrawal went through the SideSwap PAK, held by SideSwap, a bridge exchange and federation member, and stated that the key “was not compromised, nor were any others.”
Blockstream instead blamed a software bug in Elements, the codebase Liquid runs on. Security specialists put the flaw at the node level in the transaction software rather than in keys or hardware security modules. Bitcoin Magazine reported the working theory that an inflation bug created more than 4,000 LBTC that never existed before. The fake tokens were swapped for real on-chain bitcoin, and the federation’s HSM servers signed the payout because the transaction looked valid to them.
Under normal Liquid mechanics, LBTC is burned on the sidechain before bitcoin is released on the mainchain, with withdrawals sent only to approved whitelist addresses. Here the payout went to an address ending in 6gyqjlte. A small payment to that address carried an OP_RETURN reading “Please contact security@blockstream.com,” presumably from a Blockstream address, though that has not been confirmed. A later message pointed to a Signal handle, which may be spam.
White hat or thief
The self-applied white hat label has precedents. After the Euler Finance exploit in 2023 and the Poly Network hack in 2021, attackers negotiated returns and kept a bounty for the finding. Whether that repeats here depends on a party nobody has identified. Blockstream has not confirmed the claim, and no verified return of funds had taken place by Monday morning. Coverage from CoinDesk and Bitcoin Magazine has questioned the label directly, noting that “white hat” is a claim, not a fact, until coins actually move back.
The mechanics of the exit raise their own questions. Liquid processes peg-outs in batches that typically take 11 to 35 minutes, Crypto Briefing noted. A withdrawal of this size clearing without interruption suggests the authorization path worked exactly as designed, which is the uncomfortable part: either the security model was bypassed, or it was used.
A heavy month for crypto infrastructure
Liquid is by far the largest single crypto security incident tracked in recent weeks. Independent trackers list a string of smaller breaches across August and September, none above $74 million.
| Incident | Period | Estimated loss |
|---|---|---|
| Liquid Network | September 2026 | ~$320 million |
| Tectonic (Cronos) | August 2026 | ~$74 million |
| Moonwell (Base) | August 2026 | ~$8.7 million |
| Termlabs | August 2026 | ~$8.5 million |
| Coinsbuy | August 2026 | ~$7.9 million |
| Aquifer (Solana) | September 2026 | ~$2.5 million |
The breach also caps a rough stretch for bitcoin-adjacent infrastructure. A lending platform linked to Crypto.com lost $6 million last week. The August Coldcard hardware wallet thefts have now reached 1,806 BTC, about $144 million, with the attacker still shuttling coins through mixers and CoinJoin. Those events sit alongside the Liquid case in what is shaping up as an expensive quarter for anyone holding keys.
What it means for the federation model
Liquid launched in 2018 as a settlement layer for exchanges and is overseen by a federation of more than 80 trading venues, infrastructure firms and asset managers. The pitch was faster settlement with reserves guarded by vetted institutions. If a node bug can produce peg-outs that signers see as valid, the core assumption behind that pitch needs another look. Federated sidechains trade trustlessness for speed, and the model only works while the federation stays secure.
Bitcoin’s base layer has never suffered a comparable consensus breach in its 15-plus year history, which is why sidechains and bridges carry their own distinct risk profile. The damage here is real but contained to one bridge asset, the difference between a bad week for Blockstream and a systemic event for holders of LBTC on connected platforms.
Liquid has not said whether the bitcoin will come back. Traders who use LBTC for margin and settlement are left holding a token backed by a wallet that is almost empty. Until coins move back to the federation address, the white hat framing remains exactly that: a framing.
discussion