Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
Crypto · updated 27m ago · 3 min read
Liquid Network Pauses After 4,000 BTC Withdrawal From Federation Wallet Over $320 Million
Approximately 4,000 BTC worth $320 million withdrawn from Liquid federation wallet. Bridge nodes disabled and the Liquid Network paused after the withdrawal.
How the incident is explained: software bug vs unexplained authorisation route.
2 of 3 outlets skipped it: immediate anchor date and confirmation block details for the withdrawal.
“Liquid says the funds were created through an Elements software bug, not a compromised SideSwap key.”
“Liquid said the money left through a working authorization key rather than a stolen one, which leaves the route into the peg unexplained.”
One side asserts a bug; the other stresses the peg-out route remains unresolved.
$320M out, Liquid pauses
Liquid Network paused operations after a purported $320 million <a href="https://xpertsstudio.com/bitcoin-holds-79000-while-the-fed-tether-and-a-hacker-all-make-trouble/” title=”Bitcoin Holds $79,000 While The Fed, Tether And A Hacker All Make Trouble”>Bitcoin withdrawal from multisig reserve addresses on its federated Bitcoin sidechain, with the party behind the transaction claiming it was a white-hat rescue tied to a suspected security flaw.
Liquid said the withdrawal removed roughly 4,000 BTC from the Liquid Federation wallet, and it disabled bridge nodes while engineers reviewed the incident and checked whether funds remained secure.
The incident was framed as not affecting Bitcoin mainnet, because “Bitcoin blocks kept moving as normal,” while the pause concerned Liquid’s sidechain transaction processing.
Liquid’s own update also said the funds left through the SideSwap Peg-out Authorisation Key (PAK), while stressing that “that key was not compromised, nor were any others,” leaving the mechanism of the withdrawal unresolved.
White-hat messages and dispute
Survivors of the incident narrative hinge on on-chain messaging, including a later transaction that attached “we are whitehats. contact us on chain” after the withdrawal.
Blockstream responded through an on-chain message directing the actor to “[email protected],” while other reporting said the actors claimed they would return most of the Bitcoin after a vulnerability was patched and every node installed the fix.
The Defiant reported that Liquid disabled bridge nodes so no new transactions could be submitted and that exchanges were told to pause L-BTC deposits and withdrawals, while USDT, DePix and other assets issued on Liquid were unaffected.T
In parallel, the Defiant described the peg wallet as an 11-of-15 multisig constrained again by the PAK list, and it noted that the route into the peg was left unexplained because Liquid said the money left through a working authorization key rather than a stolen one.T
The Defiant also quoted Ledger’s Charles Guillemet saying the conduct did not match responsible disclosure, writing that “White hats don’t drain a bridge and then solicit an ‘on-chain’ contact,” comparing it to the Ronin bridge attack.T
What’s at risk next
Liquid’s pause immediately affected users and exchanges relying on the sidechain for transfers and settlement, because Liquid said it had disabled bridge nodes and notified exchanges to suspend L-BTC deposits and withdrawals.
“Liquid said the funds were withdrawn through the Peg-out Authorization Key, or PAK”
LCX Exchange
The Defiant reported that the wallet backing L-BTC now held 197.47 BTC after two transactions, while other reporting described the withdrawal as roughly 95% of the wallet’s approximately 4,200 BTC balance.T
Liquid also said other assets issued on Liquid, including USDT and DePix, were not directly affected, but the network-level shutdown still impacted Liquid wallets while the investigation continued.
Until Liquid publishes a post-incident report and confirms recovery, multiple outlets framed the $320 million figure as approximate value moved rather than a final loss, with the key question centered on whether the actors return the funds and what flaw allowed the peg-out.
The stakes extend beyond the withdrawn BTC because the incident raised unresolved questions about the federated peg-out controls—specifically how a withdrawal could pass authorization without the relevant key being stolen—while Blockstream and federation members worked to restore normal activity.
Source: newscord.org