Liquid, the Bitcoin sidechain operated by the Liquid Network, announced on Sunday that it had paused bridge nodes, effectively stopping new transactions on the network. The pause followed a withdrawal of approximately 4,000 Bitcoin, valued at about $320 million, from the federation wallet that backs L‑BTC issued on the sidechain.
The withdrawn amount represents roughly 95% of the wallet’s total balance of 4,200 BTC. While L‑BTC deposits and withdrawals were halted or being prepared for suspension on several exchanges, other assets issued on Liquid, such as USDT, DePix and real‑world asset tokens, remained unaffected.
Blockstream, the technology provider for Liquid, responded to the actors—who identified themselves as white‑hat hackers—through signed on‑chain messages and a PGP‑encrypted email. The actors indicated they would return most of the Bitcoin once a vulnerability was patched and every node had installed the fix. As of the latest update, the funds have not been returned.
Samson Mow, former Blockstream chief strategy officer and current CEO of Jan3, compiled a timeline of the on‑chain communications. The actors first contacted Blockstream at 11:30 a.m. Pacific time, requesting on‑chain contact. Blockstream replied within an hour, directing them to a security email address and later sending a PGP‑encrypted response. Hours later the actors asked to return the Bitcoin to a Blockstream address, conditioning the return on the vulnerability being fixed and all nodes updated. Blockstream’s reply confirmed it was addressing the return‑address request, not the patch condition.
SideSwap, a service that facilitates L‑BTC peg‑out transactions, reported that the withdrawal passed through its peg‑out service using a Peg‑out Authorization Key (PAK). SideSwap stressed that the key was not compromised and that the L‑BTC involved originated from a bug in Elements—the open‑source software underlying Liquid—rather than from SideSwap’s own systems.
Liquid and Blockstream have not provided further comment. The incident underscores the operational risks associated with federated sidechains that rely on a shared custody model for Bitcoin.
