Liquid Network, a Bitcoin sidechain developed with Blockstream, said on Sunday that purported white-hat actors withdrew about 4,000 Bitcoin from the federation wallet that backs L-BTC.
The team shared that Liquid halted new transactions and wallets on the sidechain would be disrupted. Bitcoin’s base layer continued to operate normally. Other assets issued on Liquid, including USDT, DePix, and tokenized real-world assets, were described as unaffected.
“Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved,” the X post reads.
At prevailing BTC price of nearly $80,000, as of 6:05 AM UTC, September 7, per CoinGecko data, the incident leaves the network with a massive $320 million haul. The coins represented about 95% of the reserve that had stood near 4,200 BTC—as per historical data shown on the network’s official website.
The official Liquid statement further notes that the funds left through SideSwap’s Peg-out Authorization Key and that the key itself was not compromised, nor were other federation keys. Bridge nodes were disabled so that no new transactions could be submitted. Exchanges were told to pause L-BTC deposits and withdrawals. Blockstream’s status page repeated the same account and listed public bridge nodes as the affected component.
How the peg-out was processed
SideSwap, a Liquid federation member that operates a peg-out service, said a customer sent 4,000 L-BTC to its service at 14:05 UTC on September 6. The service treated the order as routine: the L-BTC was burned on Liquid under a valid peg-out authorization, and at 14:28 UTC the federation paid about 3,996 BTC to the customer’s Bitcoin address.
Quoting Liquid’s X post, SideSwap stated that the L-BTC originated from a bug in Elements, the software that underpins Liquid, and that no SideSwap system or PAK was breached. The firm said it could not distinguish those coins from ordinary L-BTC.
On-chain records show the federation wallet later holding roughly 197 BTC. The withdrawn BTC was consolidated at address bc1q…yqjlte.
An OP_RETURN field on a follow-up transaction read: “we are whitehats. contact us on chain.” A small amount was sent back to the federation wallet. In return, Blockstream answered on-chain, asking the party to contact security@blockstream.com.
Liquid is a Bitcoin sidechain operated by a federation of members; Blockstream is its core technology provider and the firm developing Elements, the software Liquid runs on.
Independent technical analysis of Elements source and the disputed Liquid blocks attributes the inflation to a rangeproof cache bug in confidential transactions. A cache key that omitted asset and script context allowed a previously verified proof to be reused, producing unbacked L-BTC that a subset of nodes accepted. A fix had been merged to the Elements repository days earlier but had not been released in a tagged build at the time of the incident.
Claims of return and remaining questions
Later on-chain messages and PGP-signed notes indicated that the same party told Blockstream it would return most of the coins after the bug is patched and every node is updated.
“Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix,” the onchain message reads. Those messages have not been confirmed in a new statement from Liquid or Blockstream.
Ledger CTO Charles Guillemet publicly questioned the whitehat label, arguing that researchers typically disclose a flaw before moving a large reserve.
As of 6:15 AM UTC, September 7, the coins had not left the receiving address. The sidechain remained paused. Liquid said federation members were working to restore normal activity. SideSwap said existing wallets were non-custodial and unaffected, but that peg-ins, peg-outs and swaps would stay offline until the network resumes.
The episode does not change Bitcoin’s consensus rules. It does highlight the difference between main-chain settlement and a federated peg that depends on Elements software, functionary hardware and a PAK whitelist. Whether the funds are returned, how the patch is deployed, and when bridge nodes restart are still open.
The Liquid incident is, so far, September’s first major crypto security event—and it already outweighs the entire prior month. CertiK put August 2026 losses at about $215 million across all confirmed incidents, with DeFi making up $144.6 million of that total. The ~4,000 BTC taken from Liquid’s federation wallet is worth roughly $320 million, more than August’s full tally in a single Sunday peg-out.
This is a developing story and more information will be added as the event unfolds.
Also read: Coldcard Hacker Moves 45% of Wave 3 Bitcoin via THORChain and CoinJoins
