Liquid Network Pauses After $320M Bitcoin Withdrawal

Blockstream’s Liquid Network, the longest-running Bitcoin sidechain, paused operations on Sunday after roughly 4,000 bitcoin — about $320 million at current prices, or close to 95% of the sidechain’s reported reserves — was withdrawn from its federation wallet in a single unauthorized peg-out. The parties responsible left an on-chain message identifying themselves as security researchers: “we are whitehats. contact us on chain.”

What Liquid said happened

Liquid disclosed the incident in a statement on X on September 6. The network said the funds left through the SideSwap PAK, or Peg-out Authorization Key — the mechanism SideSwap uses to authorize withdrawals — but stressed that the key itself “was not compromised, nor were any others.” The statement did not explain the root vulnerability that allowed the withdrawal to execute.

Blockstream said it was working to contact the parties through a signed on-chain message. As of Sunday afternoon it had not confirmed whether the funds would be returned, and had not identified who withdrew them.

A network-wide pause

Liquid said it disabled its bridge nodes temporarily, blocking new transactions from being submitted, and notified exchanges, which “have already paused (or will pause)” LBTC deposits and withdrawals. LBTC is Liquid’s bitcoin-backed token, used for faster and confidential transfers and as collateral for assets issued on the sidechain.

“Effectively, the Liquid sidechain is paused until this issue is resolved,” the network wrote. Federation members — the set of organizations that jointly secure the network’s bitcoin — are working on a resolution. Liquid did not say when the network would restart. Other assets issued on Liquid, including USDT, DePix and tokenized real-world assets, were unaffected by the incident itself, though wallets on the network are impacted by the halt.

Why a sidechain holds real bitcoin

Liquid is not a separate blockchain with its own currency. It is a federated sidechain: bitcoin deposited into the network is held by federation operators on the Bitcoin mainchain, and the same amount is represented as LBTC inside Liquid. That design is what makes a withdrawal of “4,000 BTC” meaningful — the bitcoin backing LBTC is real, mainchain bitcoin under federation custody, not a token minted out of thin air.

The withdrawal appears in the mainchain transaction linked to the incident, and disabling the bridge limits how quickly the funds could be moved to exchanges and sold.

What this does NOT tell you

This is not (yet) a confirmed theft, and it is not a hack of the Bitcoin mainchain — Bitcoin’s own consensus was not involved. If the actors are genuine white-hats, the standard play is to return the funds once a secure wallet is provided; several past rescue-withdrawals have ended that way. If they are not, the recovery path gets harder and slower.

The incident also says nothing about the security of self-custodied bitcoin on the mainchain. What it does expose is the risk profile of the custody layer: LBTC holders are exposed to federation and application-layer risk (here, a SideSwap-related key path), which is a different threat model from holding bitcoin directly. Liquid’s reported reserves stood near 4,200 BTC before the withdrawal; roughly 4,000 of them moved in one transaction.

The next material facts are the ones not yet public: whether Blockstream’s signed message reaches the withdrawers, whether the bitcoin comes back, and what the root cause turns out to be. Until then, the sidechain stays paused and LBTC deposits and withdrawals stay frozen at exchanges.