Liquid Network Hack Drains $320M in Bitcoin Reserves

High attention and emotional sentiment detected.

The Liquid Network hack pulled about 95% of the sidechain’s Bitcoin reserves. As a result, Blockstream paused the network and told exchanges to halt L-BTC deposits and withdrawals.

How the Liquid Network Hack Unfolded

The trouble started at about 14:05 UTC. A customer submitted a peg-out order for roughly 4,000 L-BTC through SideSwap.

SideSwap runs a peg-out service that burns L-BTC and releases the matching Bitcoin. So the request looked routine at first.

Then the Liquid Federation signed the withdrawal. At about 14:28 UTC, in Bitcoin block 965,783, its multisig broadcast a peg-out of roughly 3,996 BTC.

Soon after, the funds landed at a single address. That wallet then held about 3,998.5 BTC, according to mempool.space data.

The main peg-out transaction, tagged 8db751a6, confirmed in block 965,783. A later transaction then carried the white-hat message and returned a token amount to the federation.

How Liquid’s Peg System Works

Liquid is a Bitcoin sidechain that Blockstream launched in 2018. A federation of functionaries holds the pegged Bitcoin in an 11-of-15 multisig wallet.

To move value in, users lock BTC and mint L-BTC. To move value out, they burn L-BTC and unlock the matching Bitcoin.

Because the system gates withdrawals with Peg-out Authorization Keys, funds normally reach only approved addresses. Therefore the federation trusts a request once the keys and the burn check out.

A Software Bug, Not a Stolen Key

This was not a stolen key. Liquid and SideSwap say the SideSwap Peg-out Authorization Key stayed secure, and so did every other federation key.

Instead, the root cause sits in Elements, the software that powers Liquid. Reportedly, the flaw let the attackers mint L-BTC that no real Bitcoin backed.

The attackers then burned that inflated L-BTC and asked for the Bitcoin back. Because the burn and the authorization looked valid, the federation’s hardware signed the release.

In effect, the Liquid Network hack turned a normal peg-out into a $320 million withdrawal. Both CoinDesk and Reuters traced the loss to the Elements flaw rather than any key theft.

The On-Chain Negotiation Begins

By 18:30 UTC, the actors sent a message. They moved the funds through a consolidation transaction and attached a note in the OP_RETURN field.

OP_RETURN is a small data field that lets anyone attach text to a Bitcoin transaction. The note read: “we are whitehats. contact us on chain.”

Blockstream answered on-chain within hours. The team returned 1,000 sats and wrote, “Please contact security@blockstream.com,” according to on-chain records.

After that, both sides traded more notes, and some arrived PGP-encrypted. The actors said they would return “most” of the funds once every node runs a patched version.

In one later message, the actors wrote: “Please fix the bug first. Make sure every node is patched. Then we will transfer the money back safely.”

Galaxy Research and independent on-chain analysts amplified the exchange as it happened. So the crypto community got a rare, live view of a hack negotiation.

Bitcoin Price Holds Despite the Drain

Despite the scale, the Liquid Network hack barely moved the Bitcoin price. BTC traded between about $79,200 and $80,500 around September 6 and 7.

In other words, the market treated the event as contained. Because the exploit hit L-BTC alone, spot Bitcoin liquidity stayed intact.

Still, the incident dents confidence in Liquid’s design. The sidechain now backs far less Bitcoin than it did a day earlier.

Traders on X reacted with a mix of alarm and dark humor. Some called it a forced bug bounty, while others flagged the risk of federation-based sidechains.

Skeptics Question the White-Hat Label

Still, not everyone trusts the white-hat framing. Liquid itself uses the word “purported,” and it has not confirmed the actors’ intent.

Ledger chief technology officer Charles Guillemet questioned the label in public. He compared the drain-then-contact pattern to past bridge hacks such as Ronin.

The word “most” also leaves room for doubt. Analysts note that the actors could keep a slice and still frame the return as a success.

Yet no one disputes the withdrawal itself. On-chain data still shows the roughly 3,998.5 BTC sitting in the attacker address as of Monday.

What the Liquid Network Hack Means Next

For now, the Liquid sidechain stays paused. Other Liquid assets, including USDT and DePix, remain unaffected, according to the official statement.

Meanwhile, the federation wallet holds only about 197 BTC after the drain. So a full recovery depends almost entirely on whether the actors keep their word.

Blockstream has not shared a verified patch timeline yet. Until every node upgrades, the network cannot safely restart.

Ultimately, this incident shows how one consensus bug can undo a federation’s careful key security. Readers should treat any recovery estimate as tentative, and this article is not financial advice.