Blockstream’s Liquid Network has halted new transactions after around 4,000 Bitcoin worth roughly $320 million was withdrawn from its federation wallet in a security incident, with the people behind the withdrawals claiming to be white-hat hackers.

Liquid Network said on September 6 that approximately 4,000 of the 4,200 BTC held in its federation wallet had been withdrawn. The network described the actors as “purported white-hat hackers” and said Liquid wallets would be affected while new transactions were halted.

The incident affects the Bitcoin-based payments and settlement network developed by Blockstream. Liquid is designed as a Bitcoin sidechain that allows users and institutions to move BTC into Liquid as Liquid Bitcoin (LBTC), which is backed 1:1 by Bitcoin held on the mainchain.

Around 4,000 BTC Leaves Liquid Federation Wallet

Liquid Network announced on X that around 4,000 BTC was withdrawn from its federation wallet, leaving most of the roughly 4,200 BTC previously held there outside the wallet. The withdrawal was valued at approximately $320 million.

Liquid said the funds were withdrawn through SideSwap, a settlement platform permitted to process withdrawals from the network. The network also said the key used in the withdrawal process was not compromised.

That detail is important because it means the incident cannot yet be described simply as a stolen private key. Liquid Network has not yet explained exactly how the attackers authorized or executed the withdrawals.

Why Liquid’s Federation Wallet Matters

Liquid’s federation wallet is central to the network’s Bitcoin peg. When Bitcoin is transferred from the Bitcoin mainchain to Liquid, it is locked, and an equivalent amount of Liquid Bitcoin (LBTC) is issued on the sidechain.

Blockstream’s documentation says Liquid’s functionaries use an 11-of-15 multisignature arrangement for peg-out transactions. The system is designed so that more than two-thirds of the functionaries must act honestly for the BTC held by the federation to remain secure.

The same documentation says peg-outs involve verifying that the LBTC has been burned and that the Bitcoin transaction is being sent to a whitelisted address.

That makes the reported withdrawal particularly notable: the funds moved through SideSwap, while the key used in the process was not compromised. The available information does not yet provide enough detail to determine precisely which part of the authorization process was exploited.

Attackers Claim to Be White Hats

The identity and intentions of the people who withdrew the Bitcoin remain unclear. Liquid referred to them as “purported white-hat hackers,” rather than confirming that they were legitimate security researchers. 

The distinction matters because the term white hat normally refers to someone who exploits a vulnerability to identify or fix a security problem rather than steal funds.

Pluang reported that Blockstream was attempting to contact the attackers after the withdrawal and described the incident as involving a software bug.

Other reports published after the initial disclosure said the actors offered to return most of the withdrawn Bitcoin if the underlying issue was fixed. That development remains separate from Liquid’s initial confirmation and should not be treated as proof that the actors were authorized security researchers.

Liquid Halts New Transactions

Liquid said it halted new transactions as a precaution after discovering the incident. The network warned that Liquid wallets would be affected, meaning users could face disruption while the incident was investigated.

The halt matters because Liquid serves as a settlement network for digital assets, including LBTC. Blockstream describes Liquid as a Bitcoin layer-2 and sidechain designed for faster, more confidential settlement, with users including exchanges, trading desks, institutional investors, and digital-asset managers.

The incident therefore affects more than the BTC sitting in a single wallet. Any prolonged interruption to peg-ins, peg-outs, or related settlement activity could affect participants relying on Liquid for moving assets between the Bitcoin mainchain and the sidechain.

What Is Known About the $320 Million Liquid Hack

Table 1. What is currently known about the Liquid Network security incident.

The exact attack mechanism remains unknown. Available information indicates the withdrawal was not caused by a straightforward compromise of the key used to authorize the transaction, raising the possibility that attackers exploited a flaw in the software, transaction-validation process, or federation controls. Until Blockstream completes its investigation, it cannot attribute the incident to a specific vulnerability.

Why the Incident Matters for Liquid Bitcoin

Liquid Bitcoin is designed to maintain a 1:1 relationship with Bitcoin held on the mainchain. The federation’s BTC reserves therefore directly support the LBTC supply.

A large reduction in those reserves could raise questions about the network’s ability to process peg-outs if the withdrawn BTC cannot be recovered.

That does not mean LBTC automatically becomes worthless or that every Liquid user has lost funds. The available sources do not establish the final impact on the LBTC supply, user balances, or the network’s ability to restore normal operations.

Those questions will depend on Blockstream and Liquid’s investigation and on what happens to the withdrawn Bitcoin.

What Comes Next

The main priorities are finding out how about 4,000 BTC left Liquid’s federation wallet, whether an Elements software bug was involved, whether the funds can be recovered, and whether the actors were real white-hat researchers.

For users, the key question is whether Liquid can restore its Bitcoin reserves and resume normal peg and settlement operations. The incident also raises concerns about Liquid’s security model, which relies on federation members, multisignature authorization and peg-out controls. Blockstream says its 11-of-15 arrangement is secure as long as more than two-thirds of functionaries remain honest.

Until the technical cause is confirmed, it is unclear which part of that model failed. Confirmed facts include that around 4,000 BTC, worth roughly $320 million, left the federation wallet, new transactions were halted, and the actors remain unidentified. Liquid says the withdrawal key was not compromised.

What This Means for You: Liquid users should expect possible problems with transactions, peg-ins, peg-outs, and other settlement activity while the investigation continues. If you hold LBTC or use Liquid through an exchange, wallet, or trading platform, check official service updates before moving funds.

Avoid unconfirmed claims about the attackers, the alleged software bug, or Bitcoin recovery. The incident does not establish that all Liquid users have lost funds or that LBTC is no longer backed. However, the withdrawal of approximately 4,000 BTC raises questions about Liquid’s reserves and its ability to process redemptions if the funds are not recovered.