Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
Add to Google Preferred Sources
The Bitcoin sidechain Liquid Network paused operations on September 6 after nearly 4,000 BTC, valued at approximately $320 million, was withdrawn from its federation reserves by actors claiming to be white-hat hackers. The funds represented about 95% of the network’s bitcoin reserves. Blockstream, which developed Liquid, said the withdrawal used a valid SideSwap peg-out authorization key, though no evidence of key compromise was found. An on-chain message stated, ‘we are whitehats. contact us on chain.’ The identity of the parties and whether the bitcoin will be returned remain unknown. Exchanges have begun halting L-BTC deposits and withdrawals, while other assets on the network were not directly affected. The incident raises broader questions about the security and trustworthiness of federated sidechain models in the Bitcoin ecosystem.
Key Elements
A Bitcoin sidechain used by exchanges and institutional traders suspended operations after nearly 4,000 BTC, worth roughly $320 million, was pulled from its federation reserves by unidentified actors claiming to be white-hat hackers.
The withdrawal, which occurred on September 6, drained approximately 95% of the bitcoin held in reserve by the Liquid Network, a federated sidechain developed by Blockstream. Before the incident, the network’s bitcoin reserves stood at around 4,200 BTC. The funds were moved associated with SideSwap, though Blockstream said there is no evidence the key itself was compromised
An on-chain message attached to the bitcoin transaction read: “we are whitehats. contact us on chain.” Blockstream has since attempted to reach the party responsible using a signed on-chain message, but as of the latest update, neither the identity of the actors nor any commitment to return the funds has been confirmed.
Liquid said in a post on X that the coins were withdrawn by “purported white-hat hackers” and that the network’s bridge nodes had been temporarily deactivated to prevent new transactions from being submitted. “The Liquid sidechain is effectively paused until the issue is resolved,” the network stated.
Several cryptocurrency exchanges have either halted or announced plans to halt deposits and withdrawals of L-BTC, the token that represents bitcoin on the Liquid sidechain. Other assets issued on the network, including USDT, DePix, and real-world assets, were not directly affected by the breach
How the Withdrawal Unfolded
On-chain data shows a transaction identified as “8db751…a7b140” moved approximately 3,996 BTC to a single address and was confirmed in Bitcoin block 965,783 at 14:28:56 UTC on September 6. A corresponding peg-out of 3,996.01834922 L-BTC was recorded on Blockstream’s explorer.
A separate OP_RETURN output in transaction “c103de…e69a19” carried the white-hat message. The valid use of the SideSwap PAK, combined with the absence of evidence that the key was breached, raises questions about where exactly in the control path the failure occurred.
Liquid’s technical documentation describes a Strong Federation model in which spending bitcoin held by the federation requires approval from more than two-thirds of watchmen. The PAK is designed so that even if a set of functionaries were compromised, they could not redirect user funds to attacker-controlled addresses. The fact that a valid PAK was used without apparent key compromise suggests the issue may lie elsewhere in the operational chain.
The Block and Bitcoin Magazine both reported on the withdrawal, but neither outlet established the true motive or identity of those responsible. The white-hat label remains a claim rather than a verified fact.
A Test for Federated Bridges
The incident strikes at the core of Liquid’s trust model. Unlike Bitcoin’s base layer, which relies on decentralized mining and full-node validation, Liquid depends on a defined group of functionaries to manage peg-ins and peg-outs and to safeguard the underlying bitcoin. A large, unexplained withdrawal from that reserve undermines the arrangement’s credibility.
According to a TRM Labs report, infrastructure and operations vulnerabilities accounted for roughly 15% of crypto incidents during the first half of 2026 but were responsible for 76% of total monetary losses. That disparity underscores how disruptions related to custody and bridges can outweigh the cumulative impact of months of smaller exploits.
Research published in July 2026 noted that only about 0.8% of circulating BTC is employed in decentralized finance, compared with up to 30% of Ethereum. The authors cited trust and institutional infrastructure as major reasons capital has not flowed into Bitcoin-based DeFi.
Blockstream’s May roadmap emphasized reducing reliance on trust-based schemes across the industry. The company is working on a BitVM 1-of-n bridge model, and if federated designs continue to produce incidents like this one, the significance of that work increases substantially.
Market Impact
The pause on Liquid Network could disrupt users and institutions that depend on the sidechain for settlement, confidential asset transfers, or L-BTC liquidity. Exchanges and trading desks that route bitcoin through Liquid may need to temporarily adjust operations while the network status remains unresolved.
More broadly, the incident is likely to renew scrutiny of federated sidechain security models within the Bitcoin ecosystem. Sidechains trade some of Bitcoin’s base-layer decentralization for speed and privacy features, relying instead on a defined federation to hold reserves. A reserve-level incident, regardless of the actors’ intent, may prompt institutional users to reassess counterparty and custody risk before Liquid Network fully resumes normal operations.
Moving bitcoin on-chain does not necessarily mean selling pressure is occurring. That depends on whether the funds reach exchanges, and there is currently no cited evidence that they have. Until the bitcoin is sent back, the white-hat label can be regarded as a claim, not a fact.
Blockstream has not publicly detailed the full resolution of the incident, and key questions about the withdrawal’s motive and outcome remain open. The situation has become not just a test of security for Liquid, but a test of the level of trust that Bitcoin users place in federated bridges.
Once added, BigGo Finance appears first in Google Search Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.
Source: finance.biggo.com