White Hats?

$320 Million in Bitcoin Stolen from Liquid Network as Sidechain Halts

co-written by newsrooms.ai07. September 2026, 10:08

Roughly 4,000 bitcoin worth about $320 million have been withdrawn from the federation wallet of Liquid Network, the Bitcoin sidechain used by crypto exchanges to settle trades. The operator confirmed the incident over the weekend in a statement on X. The people behind the withdrawal describe themselves as white-hat hackers, meaning security researchers who set out to expose a flaw. That self-description remains unverified.

The network has been effectively frozen since. Bridge nodes were disabled, so no new transactions can be submitted. Exchanges have paused L-BTC deposits and withdrawals. Other assets issued on Liquid, including USDT, DePix and tokenized real world assets, are unaffected according to the operator.

What Liquid Network Is

Liquid is a Bitcoin sidechain launched by Blockstream in 2018, meaning a separate blockchain network that is docked onto Bitcoin. It solves a practical problem for crypto exchanges: the Bitcoin blockchain is too slow for day-to-day trading. Users lock bitcoin into the network (a peg-in) and receive L-BTC at a 1:1 ratio in return. Those tokens settle faster and can carry confidential amounts, which makes Liquid attractive to trading firms, exchanges and token issuers. A peg-out reverses the process: L-BTC are burned, and the underlying bitcoin flow back out.

The locked bitcoin sit with the Liquid Federation, a group of more than 80 exchanges, infrastructure providers and asset managers, deliberately placed beyond the control of any single company. A payout requires signatures from 11 of 15 designated signing entities. On top of that, a mechanism called the Peg-out Authorization Key (PAK) ensures bitcoin can only move to pre-registered addresses.

With almost the entire reserve gone, that model itself is now in question. L-BTC is worth only as much as the bitcoin backing it.

How Blockstream Fits In

Blockstream is the company behind the technology. The firm led by Bitcoin veteran Adam Back built Liquid and supplies Elements, the software the sidechain runs on. Back is one of the few people cited by name in the Bitcoin white paper, and his 1997 Hashcash design is regarded as a precursor to proof of work. That has led some in the industry to believe he is Satoshi Nakamoto, the still unidentified person or group behind Bitcoin, a claim Back has consistently denied.

Blockstream serves as the central technology supplier and coordinator, while control over the reserves rests with the federation. The company is also active in Bitcoin beyond Liquid, with mining hardware and the Lightning implementation Core Lightning, and has raised $125 million in the past.

The Flaw Was in the Software

The way the funds left is what makes this case unusual. According to Liquid, the bitcoin were paid out through the PAK belonging to federation member SideSwap, yet that key was never compromised, and neither were any others. SideSwap says it processed the transaction like an ordinary customer order and had no way to tell the L-BTC involved apart from genuine ones.

The cause, based on what is known so far, is a bug in the Elements software. Liquid hides amounts and asset types by default using Confidential Transactions, whose validity is checked through cryptographic range proofs. To save computing time, nodes keep already verified proofs in a cache. That cache was keyed too loosely: it accounted for neither the asset commitment nor the output script. As a result, proofs could be reused and L-BTC created without any backing. Because the amounts are encrypted, the mint stayed invisible. The move only surfaced once the unbacked L-BTC were converted into real bitcoin, as Cryptobriefing and Crypto Times report.

Every federation safeguard performed exactly as designed. The multisig signatures were collected, the PAK was valid, and the matching amount of L-BTC was burned on the books. The checks simply never asked whether those L-BTC should have existed in the first place. A corresponding fix had been written into the Elements code over the summer and merged into the development branch early this month, according to analyses, but it had yet to reach the most recent release.

Of the roughly 4,200 bitcoin previously held in the federation wallet, about 197 remain. If peg-outs reopen before the funds come back, L-BTC risks slipping below its nominal value.

Negotiating on the Blockchain

Both sides are currently communicating through messages written directly into Bitcoin transactions. The counterparty opened with the line “we are whitehats. contact us on chain,” and Blockstream replied by pointing to a security contact address. The actors have since offered to return “most” of the bitcoin, according to crypto.news, on one condition: the bug has to be fixed and the patch rolled out to every node first.

“Please fix the bug first. The chain is under risk at least commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix,” reads one of the messages documented by CoinDesk. How much “most” means is unclear, and no timeline was given. So far nothing has come back, and Liquid has not said when the network will reopen.

A white hat is usually understood as someone who finds a flaw before criminal actors exploit it. In practice, such hackers often move the funds anyway and ask for a fee to return them. Whether the label fits here is contested: Ledger CTO Charles Guillemet pointed out that security researchers normally disclose a vulnerability before moving reserves of this size.

Open Questions

The Liquid Federation now faces the question of how quickly the network can restart, and under what conditions. Beyond this single case, the incident puts the trust assumptions behind Bitcoin sidechains and bridges back in focus. What broke here was the software that decides which tokens count as real, while the federation’s cryptography held. A multisig group is only as resilient as the validation logic underneath it.

The episode also adds to a longer run of security incidents across crypto. A lending platform linked to Crypto.com lost around $6 million just last week, and the Coldcard hardware wallet was affected in August.

Sources: Liquid Network on X, CoinDesk, The Block, Cryptobriefing, Crypto Times, crypto.news, defiprime