Key Takeaways:
- Around 4,000 BTC valued at approximately $320 million was removed from Liquid’s Federation wallet.
- Liquid says the funds were created through an Elements software bug, not a compromised SideSwap key.
- The actors say they will return most of the Bitcoin after the vulnerability is patched across Liquid nodes.
Bitcoin sidechain Liquid has halted network activity after roughly 4,000 BTC was withdrawn from its Federation wallet in a security incident. The actors behind the withdrawal have claimed they are white-hat hackers and have told Blockstream they intend to return most of the funds after the underlying software flaw is fixed.
Liquid Freezes Bitcoin Operations
After the accident, the functionality of liquid bridge nodes was briefly suspended, making it impossible to submit new transactions on the network. Exchanges have also been notified and some have suspended or are planning to suspend L-BTC deposits and withdrawals.
The sum of money rescinded constitutes a significant part of the Bitcoin stowed away in the Federation wallet. Liquid said it had deleted a total of about 4,000 BTC worth about $320 million at the time of the incident.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds…
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
The network stated that other assets on Liquid were not impacted, such as USDT, DePix and real world assets. It has to do with L-BTC, the Bitcoin-based asset to Liquid. Each user can peg out L-BTC, which unlocks an equivalent number of Bitcoin from the Bitcoin reserves.
Read More: SecondFi Freezes Transactions After $16M ADA Incident, Launches Quarantine Recovery Mode
SideSwap Says Its Systems Were Not Compromised
According to SideSwap, a customer used its peg-out service to bring 4,000 L-BTCs into its system at 14:05 UTC. A valid peg-out authorization was received then paid to the Bitcoin address at 14:28 UTC: 3,996 BTC were sent (transaction fee 0.007 BTC).
SideSwap claimed that the Peg-out Authorization Key was not hacked, and that their systems were not broken. Blockstream, however, dubbed the L-BTC’s involved in the deal ‘bugged’ by the Elements software, which is the open source tool used to build Liquid.
SideSwap said it had no means to practically provide visibly worrying L-BTC from the normal ones due to the transaction’s authorization.
Hackers Promise to Return Most BTC
The actors have been in communication via signed Bitcoin messages from Blockstream. Alex Thorn, the chief research officer at Galaxy Digital, detailed the exchange, revealing it was a case in which the group directed Blockstream to fix the vulnerability prior to recovery.
In one message, the actors said they would send most of the Bitcoin back to the Federation address after confirming that every Liquid node had been updated.
They also sent encrypted technical information to Blockstream via PGP. Small Bitcoin transfers between the group provide on-chain evidence of communication with the federation. As of the last update, the money has not yet been returned.
Liquid stays on hold while the Blockstream and Federation members work on the network-level response. SideSwap has also restricted the placement of new peg-ins and peg-outs as well as halted new deposits until services are officially resumed.
Around 4,000 BTC remain in the middle of an intense recovery process as the subsequent phase relies on fixing the Elements vulnerability across the Liquid network.
Read More: Bits of Gold Breach May Expose 200,000 Crypto Users, But Funds Remain Safe Online
