Liquid Network Hit by $320M Bitcoin Withdrawal

Home

Bitcoin

By José Oramas September 07, 2026 In Bitcoin, Hackers

Purported white-hat hackers withdrew roughly 4,000 BTC, worth about US$320 million, from Liquid Network’s federation wallet on September 6, around 95% of its reported reserves.
Blockstream, which operates the Bitcoin sidechain, paused the network and is trying to reach the parties through an on-chain message, but has not identified them or explained the vulnerability.
Ledger chief technology officer Charles Guillemet questioned the white-hat label, saying that moving hundreds of millions before making contact departs from established practice.

Liquid Network, the Bitcoin (BTC) sidechain operated by Blockstream, paused most activity on September 6 after purported white-hat hackers withdrew roughly 4,000 Bitcoin, worth about US$320 million (AU$445 million), from its federation wallet, around 95% of its reported reserves.

Liquid, which called the episode a security incident, said the funds left through the SideSwap Peg-out Authorization Key, the mechanism that approves Bitcoin withdrawals from the sidechain and normally releases coins only to pre-approved addresses.

The party left an on-chain message reading “we are whitehats. contact us on chain”, carried on a Bitcoin transaction tied to the withdrawn funds. Blockstream said it is trying to reach them with a signed message of its own.

https://twitter.com/Liquid_BTC/status/2096696272447218108

A Contested White-Hat Claim

Ledger chief technology officer Charles Guillemet questioned the label. Withdrawing hundreds of millions of dollars before making contact “is completely different from disclosing a vulnerability, and this conduct diverges from established whitehat practices”, he said.

Onchain trackers put the federation wallet’s balance at about 4,200 Bitcoin before September 6, and roughly 200 afterward. The wallet holds the Bitcoin that backs Liquid’s main token one for one, releasing coins only as matching L-BTC is destroyed.

Blockstream disabled the network’s bridge nodes, so no Bitcoin can peg in or out, and told exchanges to pause L-BTC deposits and withdrawals.

It has not said when it will lift the pause, though the sidechain itself kept producing blocks. Other assets issued on Liquid, including Tether’s USDT, the Brazilian real stablecoin DePix and tokenised real-world assets, were unaffected.

The network has carried institutional issuance before, like Bitfinex Securities revived tokenised bond sales on Liquid in March.