L-BTC holders on the Liquid Network cannot redeem their bitcoin after purported white-hat hackers withdrew roughly 4,000 BTC, worth about $320 million at reporting time, and the federation paused the sidechain.
Liquid Network confirmed the incident on Sept. 6, saying bridge nodes were disabled so no new transactions can be submitted. The chain still produces blocks, but deposits and withdrawals of L-BTC are stopped, and exchanges have been told to pause L-BTC deposits and withdrawals. “Federation members are actively working on resolving this so we can restore normal network activity,” the network said in its statement.
For anyone holding L-BTC, the practical effect is that the underlying bitcoin is simply not redeemable while the network is paused. While the pause lasts, what users hold is a claim on a wallet that is nearly empty, and their savings are effectively at risk until funds come back or reserves are restored. How much of Liquid’s roughly $320 million in pegged BTC sits with retail users versus corporations is largely unknown, because the chain is used mostly for exchange settlement and its holder composition is private.
The loss touches nearly everything in the peg. The federation wallet held about 4,200 BTC before the withdrawal; roughly 200 BTC remained after, per the network’s proof-of-reserves page. Other Liquid assets, including USDT, DePix and tokenized real-world assets, were unaffected, and Bitcoin’s mainchain is untouched.
SideSwap, the swap service through which the withdrawal was cashed out, said its non-custodial wallets are unaffected and that peg-outs already paid on Bitcoin are complete. Users with a peg-in or peg-out that did not finish are being asked to contact the service with a transaction ID so each case can be handled individually. The service has paused all swaps until the network resumes. Liquid has not said when the network will reopen.
The actors, who left an on-chain message reading “we are whitehats. contact us on chain,” have pledged to return most of the funds once the bug behind the incident is fixed and every node is patched. Blockstream, Liquid’s technology provider, later sent a PGP-signed on-chain message stating bridge nodes are patched. As of the latest reporting on Sept. 7, about 3,998.5 BTC remained unmoved in the actors’ address. The return is a pledge, not a fact, and the actors’ identities are unknown.
Meanwhile, a fix for the underlying Elements bug had reportedly been added to the software five weeks before the incident, though that account comes from a single report and no independent technical postmortem has been published.
