Liquid Network suffered a major security incident on September 6 after nearly 4,000 BTC, worth about $320 million, moved from its federation wallet. The incident forced the Bitcoin sidechain to pause operations while Blockstream investigated the withdrawal.
Liquid described the actors as “purported white-hat hackers,” but their intentions remain unconfirmed. An on-chain message claimed the attackers were white hats and asked the network to contact them. Blockstream has since attempted to establish communication through the blockchain.
The incident raises immediate questions about the security of Liquid’s Bitcoin peg and the controls governing withdrawals from its federation wallet.
Liquid pauses network activity
The transferred funds moved through a peg-out transaction that released Bitcoin from reserves backing Liquid Bitcoin, or LBTC. On-chain data indicated that about 3,996 BTC reached an external Bitcoin address.
Liquid subsequently paused the network and took steps to limit further activity. Exchanges also moved to suspend LBTC deposits and withdrawals as the investigation continued.
The breach did not involve a compromise of the Bitcoin base layer. Instead, the incident centers on Liquid’s federation and the mechanisms used to authorize peg-outs.
Funds remain uncertain
The biggest unanswered question is whether the Bitcoin has actually been lost.
The on-chain message suggests the unidentified party may claim to have removed the funds as a security measure. However, that claim has not been independently established. Until the Bitcoin is returned or the actors provide convincing evidence, the funds should be treated as potentially compromised.
The incident also puts renewed attention on the risks surrounding federated Bitcoin bridges. Liquid relies on a group of federation participants to safeguard the Bitcoin backing its sidechain assets.
For users and investors, the immediate focus will be whether Blockstream can rec over the funds and identify how the unauthorized withdrawal occurred. The outcome could also influence confidence in Liquid and other systems that rely on custodial or federated infrastructure.
