Bitcoin sidechain Liquid paused operations after actors claiming to be white-hat hackers withdrew about 4,000 Bitcoin worth $320 million from its federation wallet.
On Sunday, Liquid said that bridge nodes were disabled, preventing new transactions, while exchanges had halted or were preparing to halt L-BTC deposits and withdrawals.
Blockstream, Liquid’s technology provider, started contacting the actors through signed onchain messages. Subsequent messages show the actors told Blockstream to patch the vulnerability and ensure every node was updated before they would return most of the Bitcoin.
They also sent encrypted technical details to Blockstream, according to Galaxy Digital research head Alex Thorn. At the time of writing, the funds had not been returned.
SideSwap said the withdrawal passed through its peg-out service as a customer order using its Peg-out Authorization Key (PAK), but that the key was not compromised. It said the L-BTC used in the transaction originated from a bug in Elements, the open-source software underpinning Liquid, rather than SideSwap’s systems.
Cointelegraph reached out to Liquid Network and Blockstream for comment.
The withdrawn Bitcoin represented roughly 95% of the wallet’s approximately 4,200 BTC balance before the incident. Liquid said other assets issued on the network, including USDT, DePix and real-world assets, were unaffected. The sidechain remained paused while federation members worked to fix the vulnerability.
This is a developing story, and further information will be added as it becomes available.
Related: ‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest