LONDON — Liquid Network, a Bitcoin-based payments and settlement network used by cryptocurrency exchanges and institutions, says about 4,000 bitcoin worth roughly $320 million was withdrawn from its federation wallet in a major security incident.
The withdrawal represented nearly all of the 4,200 bitcoin held in the wallet, according to the network’s public statement. Liquid said it had paused new transactions, disabled bridge nodes and warned users that Liquid wallets would be affected while federation members investigate.
The network described those responsible as “purported white-hat hackers,” a term generally used for people who identify security flaws without intending to keep stolen funds. But Liquid did not provide evidence confirming the attackers’ identity, intent or any agreement to return the bitcoin.
“Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet,” Liquid said in a post on X.
The incident is significant because Liquid’s model depends on bitcoin reserves that back its L-BTC token. L-BTC is intended to be redeemable one-for-one for bitcoin held in the federation wallet. If the reserve has been drained, questions arise about whether users can redeem L-BTC for underlying bitcoin until the issue is resolved.
The incident is also the latest reminder that crypto systems can remain vulnerable even when the underlying Bitcoin blockchain itself is not compromised. The reported breach affected a separate, federated sidechain built to make Bitcoin transfers faster and more useful for exchanges and financial applications.
Liquid said other assets on the network, including USDT, DePix and real-world assets, were unaffected.
What happened
Liquid Network said the funds were withdrawn through SideSwap, a settlement platform authorized to process “peg-out” transactions from Liquid back to the Bitcoin main blockchain.
A peg-out is the process by which L-BTC, the Liquid version of bitcoin, is redeemed for ordinary bitcoin on the Bitcoin blockchain.
Under normal conditions, a user sends L-BTC into the Liquid system and receives an equivalent amount of bitcoin from the federation’s reserve wallet. The reserve is supposed to ensure that each L-BTC token is backed by bitcoin.
Liquid said the withdrawal occurred through SideSwap’s Peg-out Authorization Key, known as the PAK.
“What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others,” Liquid said.
The statement leaves major questions unanswered.
If the key was not compromised, investigators will need to determine how the peg-out process was authorized, whether a software vulnerability was exploited, whether the system incorrectly recognized invalid withdrawal requests, or whether other controls failed.
Liquid has not publicly described the precise technical vulnerability. It also has not said whether the funds can be frozen, recovered or traced to a known entity.
The network said Blockstream, the company associated with Liquid, was attempting to contact the people who withdrew the funds through a signed message on the Bitcoin blockchain.
That method allows the network to communicate publicly with the holder of a Bitcoin address without needing to know the person’s identity.
For now, the bitcoin remains outside the federation wallet.
Liquid pauses the network
Liquid took immediate steps to contain the incident.
The network said bridge nodes had been temporarily disabled, meaning users could not submit new transactions to the Liquid sidechain. It said the sidechain was effectively paused until the issue could be resolved.
“Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals,” Liquid said.
That response is designed to prevent additional losses and stop users from moving assets into a system with an impaired reserve.
But a pause also creates disruption.
Users holding L-BTC may be unable to transfer, trade or redeem their assets. Exchanges that list L-BTC may suspend deposits and withdrawals. Traders and market makers could face uncertainty about whether L-BTC maintains its usual one-to-one value with bitcoin.
The network’s statement said “Liquid wallets will be impacted” and apologized for the inconvenience.
The word “inconvenience” understates the potential stakes for users. If L-BTC cannot be redeemed for bitcoin because the reserve is unavailable, the token’s value could become uncertain.
Liquid did not say how much L-BTC is currently held by individual users, exchanges or institutions. It also did not release a timetable for restarting the network.
The federation members, a group of exchanges, infrastructure firms and asset managers that help operate the network, are “actively working on resolving this,” Liquid said.x+1
What is Liquid Network?
Liquid Network is a federated Bitcoin sidechain developed by Blockstream and launched in 2018.
A sidechain is a separate blockchain connected to a main blockchain. It is designed to offer functions that the main chain may not provide efficiently.
Bitcoin’s main blockchain is widely regarded as secure and decentralized, but transactions can take time to confirm, and fees can rise during periods of high activity. That can make it less convenient for exchanges and traders who need faster settlement.
Liquid was designed to address that problem.
It allows participants to move bitcoin into the Liquid system, where it becomes L-BTC. L-BTC can then be transferred more quickly and confidentially within the sidechain. When users want to exit, they can redeem L-BTC for bitcoin through a peg-out process.
The network is used for exchange settlement, asset issuance, trading and institutional transfers. It was not designed to replace Bitcoin’s main chain; it was designed to make certain transactions faster and more flexible.
But Liquid’s design differs from Bitcoin’s in a crucial way.
Bitcoin is secured by a decentralized network of miners and nodes. Liquid is governed by a federation of more than 80 members, including exchanges, infrastructure companies and asset managers, according to CoinDesk.
The federation operates functionaries that help secure the sidechain and control the bitcoin held in reserve.
That architecture can improve speed and privacy. It can also create concentration risk.
A federated system depends on the security of its governance, software, authorization processes and reserve custody. If one of those layers fails, the underlying bitcoin may be exposed.
The $320 million incident puts that risk in stark focus.
Why the reserve matters
The Liquid Federation wallet is the backbone of the L-BTC system.
The roughly 4,200 bitcoin held there was meant to back L-BTC on a one-to-one basis. A user who holds 1 L-BTC expects that the system has 1 bitcoin in reserve to support a redemption.
If 4,000 bitcoin has been withdrawn, only a small portion of the original reserve appears to remain.
That does not necessarily mean every L-BTC holder has lost money. The final outcome will depend on several factors:
- Whether the bitcoin is returned.
- Whether the federation has insurance, reserves or other recovery mechanisms.
- Whether the withdrawal can be reversed through any technical or legal process.
- How much L-BTC was outstanding at the time of the incident.
- Whether exchanges and liquidity providers can maintain market confidence during the pause.
But the incident creates a clear liability question.
L-BTC is intended to represent bitcoin locked in custody. If the custody reserve is depleted, users need to know who bears the loss, the federation, participating exchanges, Blockstream, SideSwap, insurers or token holders.
Liquid has not yet provided public answers.
The network’s claim that other Liquid assets such as USDT, DePix and real-world assets are unaffected is important but limited.
Those assets may use different issuance, custody or reserve mechanisms. Their operational status does not resolve the core question about L-BTC’s bitcoin backing.
The “white-hat” claim
The alleged attackers have been described as “white-hat hackers,” but the phrase should be treated carefully.
In cybersecurity, a white-hat hacker is someone who identifies a vulnerability to help an organization fix it. Such researchers may participate in bug-bounty programs, disclose flaws responsibly and receive a reward.
Sometimes a person who takes funds from a vulnerable crypto protocol claims to be a white hat and says the assets will be returned after a fee or negotiation.
But calling oneself a white hat does not make the claim true.
The essential questions are whether the funds are returned, whether the organization authorized the testing, whether users were put at risk and whether the person demanded payment or other concessions.
Liquid’s statement said the attackers were “purported” white hats, signaling that the network has not independently confirmed the claim.
Until the bitcoin is returned or a verifiable agreement is reached, the incident should be understood as an unresolved security breach involving $320 million in customer- and network-relevant reserves.
The distinction matters because the crypto industry has seen cases where attackers initially claim ethical motives, then negotiate for a large payment, delay the return of funds or move assets through mixers and exchanges.
The blockchain’s transparency may help investigators track the bitcoin, but tracing funds is not the same as recovering them.
A warning for crypto infrastructure
The incident is not a hack of Bitcoin itself.
Bitcoin’s main blockchain continues to operate normally. The theft did not involve rewriting Bitcoin’s transaction history, compromising the Bitcoin protocol or breaking the cryptography that secures private keys on the main chain.
Instead, it affected a separate system built around Bitcoin, a network that aims to make transfers faster by holding bitcoin in a federation-managed reserve and issuing a corresponding asset on a sidechain.
That distinction is technically important, but it does not reduce the practical impact for users of Liquid.
The episode highlights a central tension in crypto infrastructure.
Systems that provide faster settlement, lower fees, privacy features or cross-chain functionality generally require extra layers of trust. Those layers may rely on smart contracts, bridge software, multi-signature wallets, federations, authorization keys or centralized operators.
Each added layer can create an additional attack surface.
Bridges, systems that move assets between blockchains, have been among the most frequently targeted components in the crypto industry. They often hold large pools of assets and depend on complex authorization logic.
Liquid is not a conventional smart-contract bridge, but its peg-in and peg-out design shares some of the same risks. It has to make sure that assets crossing chains are properly approved, and that reserves are preserved.
The reported withdrawal through the SideSwap PAK suggests that bridge and authorization logic will be central to the investigation.
The market context
The breach comes during a period of heightened scrutiny of crypto security.
Digital assets have grown more integrated with mainstream finance, but large hacks continue to expose weaknesses in exchanges, bridges, decentralized-finance platforms and custody systems.
For investors, the Liquid incident reinforces the difference between holding bitcoin directly and holding a bitcoin-linked asset issued by another system.
Direct bitcoin ownership depends on control of the private key. L-BTC ownership depends on the Liquid network’s ability to preserve its reserve, maintain the peg and process redemptions.
Both can carry risk, but the risks are not identical.
The incident could also affect confidence in Bitcoin sidechains and federated settlement networks more broadly. Exchanges use such systems because they offer speed and operational efficiency. But a major reserve loss may prompt them to review exposure, pause integrations or demand more transparency about custody arrangements.
The immediate market impact on bitcoin itself was limited in early trading, according to crypto market reports. But the incident could matter more for institutions and users who rely on Liquid for settlement or asset issuance.
What users should do
Users with L-BTC or other assets on Liquid should monitor official updates from Liquid Network, Blockstream, SideSwap and the exchange or wallet they use.
They should be cautious about phishing attempts. Major hacks often result in false recovery messages, fake support accounts, scam websites offering to help victims get their money back.
Key steps include:
- Do not share seed phrases or private keys with anyone claiming to represent Liquid, Blockstream or an exchange.
- Verify announcements through official company websites and verified social-media accounts.
- Check whether an exchange has paused L-BTC deposits, withdrawals or trading.
- Avoid relying on unverified claims that funds have been recovered.
- Keep records of balances, transactions and any notices received from a platform.
Users should also understand that a network pause may be necessary for security but can limit access to funds for an unknown period.
What happens next
Liquid’s immediate priorities are clear: determine the technical cause, contain the incident, communicate with the party holding the bitcoin and establish whether the reserve can be restored.
The questions that remain include:
- How did the withdrawal pass through the authorized peg-out mechanism?
- Why does Liquid say the PAK was not compromised?
- Was the vulnerability in SideSwap, Liquid software, federation processes or another component?
- Are L-BTC holders fully backed after the withdrawal?
- Will the bitcoin be returned?
- Who is responsible if it is not?
- When can the network safely resume transactions?
Liquid has said federation members are working to restore normal activity, but it has not given a timeline.
The case will likely become an important test for federated Bitcoin systems.
A recovery could strengthen the argument that transparent, coordinated operators can respond to a major breach. A failure to recover the funds could deepen doubts about the safety of sidechains and the risks of keeping large reserves behind complex bridge mechanisms.
For now, about 4,000 bitcoin, worth roughly $320 million at the time of the withdrawal — sits at the center of an unresolved security incident. The people holding it say they are acting ethically. Liquid Network, its users and the wider crypto market are waiting to see whether those words are matched by a return of the funds.
