Liquid Network shut down its Bitcoin sidechain Sunday after purported white-hat hackers drained roughly 4,000 bitcoin from the federation’s reserve wallet. That is about $320 million gone in a single pull.
The withdrawal stripped close to 95% of the sidechain’s reported bitcoin reserves. Liquid disclosed it in a Sept. 6 post on X. Reserves stood near 4,200 BTC before the incident, according to The Block. Afterward, Blockstream’s proof-of-reserves page showed a little over 207 BTC remaining, per Bitcoin Magazine.
Here is how Liquid works. It is a federated Bitcoin sidechain built by Blockstream. BTC locked on the mainchain becomes LBTC on Liquid. Federation operators secure the underlying bitcoin. Peg-outs require an 11-of-15 multisig sign-off.
The exact figure was 4,019.4 BTC, per Bitcoin Magazine, moved in a single peg-out transaction through the SideSwap Peg-out Authorization Key. SideSwap operates as a bridge exchange and sits on the Liquid Federation. Liquid said that key was not compromised. Nor were any others. What allowed the withdrawal in the first place, the network did not say.
Bitcoin Magazine reports the mechanism appears to be an inflation bug on the LBTC sidechain. Over 4,000 LBTC that never existed before were created, then cashed out for on-chain bitcoin from the federation. Because the transaction looked valid under the consensus bug, federation members’ hardware security servers signed off. That account is explicitly unconfirmed.
Two sources. Two levels of detail. No confirmed answer on root cause.
The funds landed at a single bitcoin address and had not moved at the time of writing, per Bitcoin Magazine. An onchain message attached to the incident read: “we are whitehats. contact us on chain.” Liquid said Blockstream, the network’s technology provider, was working to contact the parties responsible through an onchain signed message. It did not identify them or confirm whether funds would be returned.
“Effectively, the Liquid sidechain is paused until this issue is resolved,” Liquid said in its statement. Bridge nodes went dark temporarily. No new transactions could be submitted. The sidechain continues to produce blocks, per Bitcoin Magazine, but access is limited. Liquid notified crypto exchanges, which have either suspended deposits and withdrawals for LBTC or were expected to do so.
Other assets issued on Liquid were unaffected by the security incident, Liquid said. That includes USDT, DePix, and real-world assets. Wallets holding those assets would still feel the broader disruption.
JAN3 CEO Samson Mow said that Aqua’s Liquid features were affected and that on-chain bitcoin still worked. Other wallets using Liquid were expected to face disruption. Public on-chain analytics on retail versus corporate LBTC holdings are scarce, a consequence of the chain’s private design.
LBTC holders are in a bind. The underlying BTC backing their tokens is not currently redeemable while the bridge is down. The reserves backing those tokens are mostly gone. Bitcoin Magazine speculates the hackers may ask for a finder’s fee and return the majority of funds. That is not confirmed.
The timeline is the open question. Liquid did not disclose when it plans to restart the network. Whatever messages have passed between Blockstream and the purported white-hats remain private. Whether the funds come back is the question every LBTC holder is now asking, and no one has answered it yet.
