Liquid Network Halts Activity After $320M Bitcoin Withdrawal

Liquid Network has temporarily halted operations after around 4,000 BTC, valued at roughly $320 million, was withdrawn from its federation wallet in what the Bitcoin sidechain described as a major security incident.

The withdrawal took place Sunday and accounted for nearly 95% of the approximately 4,200 BTC Liquid held in reported reserves before the incident. The parties behind the transaction later identified themselves onchain as “whitehats,” although their identities and intentions remain unclear.

Liquid said in a Sept. 6 statement on X that Blockstream, the technology company supporting the network, was attempting to establish contact with those responsible using a signed onchain message. The network has not confirmed whether the bitcoin will be returned.

The funds were reportedly moved using Liquid's SideSwap PAK, known as the Peg-out Authorization Key. Liquid said the key itself had not been compromised and that no other keys were affected. However, the network has yet to disclose the vulnerability that enabled such a large withdrawal.

An onchain message associated with the Bitcoin transaction stated that the attackers were “whitehats” and urged Liquid to contact them through the blockchain.

Following the incident, Liquid alerted cryptocurrency exchanges about the situation. Several platforms suspended, or prepared to suspend, deposits and withdrawals involving LBTC, Liquid's Bitcoin-backed token.

Liquid also temporarily shut down its bridge nodes. As a result, users cannot submit new transactions, effectively putting the sidechain on hold while federation members investigate what happened.

The network said other assets operating on Liquid, including USDT, DePix and various real-world assets, were not affected by the security breach. However, users relying on Liquid wallets may still experience disruptions while network operations remain suspended.

Liquid is a Bitcoin sidechain built to enable faster and more private transactions while supporting the issuance of digital assets. Bitcoin locked on the main Bitcoin network is represented as LBTC on Liquid, with a federation of operators responsible for safeguarding the underlying BTC.

For now, Liquid has not provided a timeline for restarting the network. The sidechain said its federation members are working on resolving the incident and restoring normal operations, while discussions with the purported white-hat hackers continue.