Liquid Network has been forced into an unusual pause after roughly 4,000 bitcoin — worth about $320 million at the time — was withdrawn from the Bitcoin sidechain’s federation wallet in a security incident.
The story has already taken an important turn. The party behind the withdrawal described itself as a white-hat hacker, and around 3,400 BTC was subsequently returned after Blockstream said its bridge nodes had been patched. Roughly 600 BTC remained with the party at the latest independently verified update.
That makes this more complicated than a conventional crypto theft. The immediate concern is the scale of the withdrawal and the vulnerability that made it possible — not simply whether somebody gained control of a private key.
What happened to Liquid Network?
Liquid said approximately 4,000 of the roughly 4,200 BTC held in its federation wallet was withdrawn. The network responded by pausing activity, disabling bridge nodes and warning that Liquid wallets would be affected while federation members worked on the problem.
The withdrawal went through SideSwap’s peg-out service. Crucially, Liquid said the Peg-out Authorization Key used in the process was not compromised.
Subsequent reporting and statements around the incident point instead to a bug involving Elements, the open-source software on which Liquid is built. The party controlling the withdrawn bitcoin communicated publicly through messages embedded in Bitcoin transactions and asked for the vulnerability to be fixed before funds were returned.
After Blockstream indicated that its bridge nodes had been patched, about 3,400 BTC was sent back to the federation address.
Why a 4,000 BTC withdrawal matters
Liquid is a Bitcoin sidechain designed for faster settlement and the issuance of digital assets. BTC moved onto Liquid is represented as L-BTC through a one-to-one peg, while bitcoin backing that system is secured by the Liquid Federation.
According to Blockstream’s documentation, the federation normally uses an 11-of-15 multisignature arrangement for peg-ins and peg-outs. That architecture is one reason this incident deserves attention beyond the headline dollar figure: the available evidence does not point to a straightforward theft of the federation’s signing keys.
If the developing explanation is confirmed, the incident instead highlights how software validation and bridge logic can become critical security boundaries even when cryptographic keys themselves remain secure.
What does this mean for Liquid users?
For people using Liquid, L-BTC or services connected to the network, the practical issue is disruption. Deposits, withdrawals, swaps and other Liquid-linked activity may remain unavailable through participating services until normal network operation is restored.
Users should avoid treating the return of most of the bitcoin as proof that everything is back to normal. A network pause and emergency patch are significant events, and a detailed technical explanation of the underlying bug will matter before the broader security implications can be properly assessed.
The incident does not mean the Bitcoin network itself was hacked. Liquid operates as a separate Bitcoin sidechain. Bitcoin’s main blockchain does not depend on Liquid for its operation.
Was the $320 million actually stolen?
That remains a question worth phrasing carefully. Liquid initially described the event as a security incident involving purported white-hat hackers. The actors themselves claimed to be white hats and later returned most of the bitcoin after asking Blockstream to patch the vulnerability.
Until the investigation and technical post-mortem are complete, calling the entire $320 million permanently stolen would overstate what is known. What is confirmed is that roughly 4,000 BTC left the federation wallet without the network expecting it, Liquid paused activity, a software problem was addressed, and most of those funds were subsequently returned.
What happens next
The next important development will be a full technical explanation from Liquid or Blockstream detailing exactly how the affected L-BTC was created and why the federation accepted the resulting peg-out.
It will also be important to watch whether the remaining bitcoin is returned and when Liquid restores normal network activity.
The Tech Boom will update this story as confirmed technical details and network restoration information become available.
Sources: Liquid Network and Blockstream technical documentation; Reuters reporting published September 7, 2026; independent reporting from The Block. Figures and network status were checked against the latest available reports before publication.
