Blockstream’s Liquid Network, a federated Bitcoin sidechain used by exchanges and institutions for faster settlement and confidential transfers, temporarily halted new activity after nearly the entire bitcoin reserve backing its L-BTC token left the federation wallet.
On September 6, 2026, two transactions moved approximately 3,998 bitcoin—worth about $320 million at prevailing prices—from the wallet that collateralizes Liquid’s pegged bitcoin.
The first transfer sent 2.5 BTC; a second, minutes later, moved nearly 3,996 BTC.
Both arrived at a previously unused address that later consolidated the coins and embedded an on-chain note: “we are whitehats. contact us on chain.”
A tiny amount was sent back to the federation wallet.Liquid Network described the actors as “purported white-hat hackers.”
Officials said the funds exited through SideSwap’s peg-out authorization key, a legitimate withdrawal path, and that the key itself had not been stolen.
Subsequent statements indicated the L-BTC redeemed in the transaction had been generated by a bug in Elements, the software that underpins Liquid.
Because the resulting peg-out appeared valid under existing consensus rules, federation hardware-security modules signed the corresponding bitcoin withdrawal.Before the incident the federation wallet held roughly 4,200 BTC.
Afterward it contained a little more than 200 BTC, or about 5 percent of the prior reserve.
Other assets issued on Liquid—USDT, DePix, and various real-world-asset tokens—were unaffected.
The Bitcoin main chain continued operating normally.In response, operators disabled public bridge nodes so no new peg-in or peg-out requests could be submitted.
Exchanges were instructed to suspend L-BTC deposits and withdrawals. Liquid wallets that rely on the sidechain are temporarily impacted.
Federation members said they were working to restore normal operations once the issue is contained.
Blockstream replied on-chain, sending a small amount to the recipient address with a request to contact security@blockstream.com.
Later messages from the same address reportedly asked developers to patch the vulnerability first and then promised a safe return of the coins.
Industry observers remain divided: some treat the episode as a responsible disclosure, while others note that draining the majority of a bridge’s collateral before announcing contact is atypical of conventional white-hat practice.
The episode underscores the complexity of federated sidechains.
Liquid relies on a multi-signature treasury requiring a supermajority of federation members to authorize bitcoin movements.
A consensus-level inflation bug that allowed newly created L-BTC to be redeemed for real bitcoin bypassed those controls without compromising any individual keys.
As of the latest official update the sidechain remains paused, communication with the unknown party continues on-chain, and no confirmation has been given that the bitcoin will be returned. Users holding L-BTC or using Liquid-dependent wallets face delays until federation members complete their investigation and apply necessary software fixes.