Liquid Network Paused After 4,000 BTC Withdrawn in Purported White-Hat Hack
On September 6, the Liquid Network, a Bitcoin sidechain, was halted after around 4,000 BTC, valued at roughly $320 million, was withdrawn from its federation wallet. This incident took advantage of a flaw in Elements software, rather than cryptographic keys, leading to the withdrawal of nearly 95% of the wallet's total of 4,200 BTC. The exploit transpired during the peg-out process, where SideSwap received 4,000 L-BTC and sent about 3,996 BTC to a user's address. The individual responsible for the withdrawal identified as white-hat hackers, proposing to return most of the funds if the vulnerability is fixed. As of September 7, Liquid remained frozen, with its bridge infrastructure offline and exchanges halting L-BTC transactions, although other assets on Liquid were said to be unaffected.
Key facts
- Approximately 4,000 BTC (worth about $320 million) was withdrawn from Liquid Network's federation wallet.
- The withdrawal occurred on September 6, 2026, at approximately 14:05 UTC.
- The exploit appears to have used a vulnerability in Elements, the software underpinning Liquid, not compromised keys.
- The federation wallet held about 4,200 BTC before the incident; about 200 BTC remained afterward.
- The party controlling the funds left an on-chain message claiming to be white-hat hackers and offered to return most funds if the vulnerability is patched.
- Blockstream responded via a signed transaction and exchanged PGP-signed messages with the hackers.
- The withdrawn bitcoin had not been returned as of publication.
- Liquid Network has paused its bridge infrastructure, and exchanges suspended L-BTC deposits and withdrawals.
Entities
Institutions
- Liquid Network
- SideSwap
- Blockstream
- Galaxy Digital
- Ledger