Bitcoin Sidechain Liquid Halts After $320M BTC Drawn in White-Hat Exploit

The Liquid Network, a Bitcoin sidechain operated by Blockstream, paused all operations on Sunday after actors claiming to be white-hat hackers withdrew approximately 4,000 BTC—worth roughly $320 million—from its federation wallet. According to Liquid, bridge nodes were disabled to prevent new transactions, while multiple exchanges began halting or preparing to halt L-BTC deposits and withdrawals. The withdrawn amount represented about 95% of the wallet's pre-incident balance of roughly 4,200 BTC, making it one of the largest known white-hat interventions in crypto history.

Blockstream, Liquid's technology provider, initiated contact with the actors through signed onchain messages. Subsequent exchanges revealed the actors' conditions: they would return most of the Bitcoin only after the underlying vulnerability was patched and every node on the network had been updated. Galaxy Digital research head Alex Thorn reported that the actors also transmitted encrypted technical details to Blockstream to facilitate the fix. As of publication, the funds had not yet been returned, and the sidechain remained paused while federation members worked to remediate the issue.

SideSwap, whose peg-out service was used to process the withdrawal, clarified that the transaction passed through its system as a standard customer order using its Peg-out Authorization Key (PAK), which was not compromised. The company attributed the exploit to a bug in Elements—the open-source blockchain platform underpinning Liquid—rather than any flaw in SideSwap's infrastructure. Liquid confirmed that other assets issued on the network, including USDT, DePix, and various real-world assets, were unaffected by the incident. The network's operators stated that operations would resume once the vulnerability was fully patched across all federation nodes.