- Liquid Network has paused transactions after nearly 4,000 BTC worth $320 million was withdrawn from its federation wallet.
- The network is investigating the incident and has yet to explain how the withdrawal bypassed its security controls.
Liquid Network has paused new transactions after nearly 4,000 BTC worth about $320 million was withdrawn from its federation wallet.
The withdrawal occurred on September 6 and involved most of the Bitcoin held in the wallet. Liquid said around 4,000 BTC was removed from approximately 4,200 BTC stored there.
The incident has forced the Bitcoin sidechain to suspend parts of its infrastructure while its team investigates how the withdrawal occurred.
Liquid Network Suspends Activity After Major Bitcoin Withdrawal
Liquid disabled its bridge nodes after detecting the large withdrawal. It also contacted exchanges and asked them to suspend L-BTC deposits and withdrawals until further notice.
The network described the individuals behind the withdrawal as purported white-hat hackers. However, that description has not been independently verified.
Blockchain data showed two transactions that moved about 3,998.5 BTC from the federation wallet. The recipient later posted an on-chain message claiming responsibility and describing the action as a security intervention.
The actor also indicated that most of the Bitcoin could be returned once the vulnerability is fixed. As of September 7, however, there was no public confirmation that any of the funds had been returned.
Bitcoin Was Withdrawn Through an Authorized Route
Liquid said the withdrawal used a Peg-out Authorization Key linked to SideSwap, a federation member that handles settlement and peg-out services.
The network said the SideSwap key was not compromised. It also reported no evidence that other authorization keys had been breached.
That statement raises questions about how the withdrawal was approved. Liquid’s peg-out system is designed to restrict Bitcoin withdrawals to authorized destinations, while federation functionaries must sign the transactions before BTC can be released onto the Bitcoin network.
Liquid has not yet explained how a withdrawal of this size passed those controls without the relevant key being compromised.
Liquid’s Other Assets Were Not Directly Affected
The incident did not involve a compromise of the Bitcoin network itself. Instead, it affected the infrastructure responsible for Liquid’s two-way Bitcoin peg.
Liquid allows users to lock BTC and receive an equivalent amount of L-BTC on the sidechain. Users can later burn their L-BTC and withdraw the underlying Bitcoin through the peg-out process.
Liquid said other assets issued on the network, including USDT and DePix, were not directly affected by the incident, although it has not yet provided a timeline for restoring normal transaction activity.
Incident Puts Liquid’s Federation Model Under Scrutiny
Liquid was developed by Blockstream as a Bitcoin sidechain focused on faster settlement and digital asset issuance. Its infrastructure is managed through a federation of exchanges, infrastructure companies and asset managers.
More than 80 organizations are part of the broader Liquid Federation. A smaller group operates the specialized infrastructure responsible for signing blocks and managing the Bitcoin peg.
This structure gives Liquid greater flexibility than Bitcoin’s base layer. However, it also means the security of the peg depends on the federation’s authorization and signing systems.
The latest incident therefore raises important questions about those controls.
Blockstream has previously researched bridge designs that could reduce the trust required to move Bitcoin between networks. Its roadmap has included a BitVM-based bridge as a longer-term research project.
That technology was not responsible for the latest withdrawal.
For now, the biggest questions are whether the Bitcoin will be recovered and what vulnerability allowed the transaction to proceed. Liquid and Blockstream will also need to determine what changes are required before the network can safely resume normal operations.
The reported $320 million should not yet be considered a confirmed permanent loss. The actor has claimed that most of the funds can be returned after the vulnerability is fixed, but that claim remains unverified.
A detailed post-incident report should provide a clearer explanation of what happened and how Liquid plans to prevent a similar event in the future.
ALSO READ: Pi Network Protocol 27 Set for September 15 as DEX and Smart Contracts Reach Mainnet
DISCLAIMER:
This article reflects the author’s views and is provided for informational purposes only. While we strive for accuracy, the publisher does not guarantee that all information is complete or current. Readers should verify important information and consult appropriate sources before making decisions based on this content.
About the Author
