preferred on
Points of Focus
- Roughly 4,000 BTC worth about $320 million left Liquid Network’s federation wallet, removing around 95% of the bitcoin reserves backing L-BTC.
- SideSwap said the L-BTC used in the peg-out had been created through an Elements software vulnerability; its PAK and systems were not compromised.
- The actors later offered to return “most” of the BTC once all Liquid nodes are patched, while their white-hat claim remains unverified.
Liquid Network stopped accepting new transactions after roughly 4,000 BTC worth about $320 million was withdrawn from the federation wallet supporting its Bitcoin sidechain. The transfer removed around 95% of the reported bitcoin reserves backing L-BTC and prompted exchanges to suspend L-BTC deposits and withdrawals. The wallet’s Bitcoin reserves fell from roughly 4,200 BTC to 207.275 BTC after the withdrawal, according to Blockstream’s Liquid explorer, leaving roughly 5% of the pre-incident balance.
In a Sept. 6 statement, Liquid said bridge nodes were temporarily disabled while federation members worked on a fix. Bitcoin mainnet was unaffected, and Liquid said issued assets including USDT, DePix and RWAs were not affected by the incident.
How 3,996 BTC left the federation wallet
Liquid uses a two-way peg. BTC is locked in a federation-controlled wallet when L-BTC is created, while L-BTC is burned when BTC is released back to Bitcoin. Peg-outs require a Peg-out Authorization Key, or PAK, which limits who can request withdrawals. Liquid’s model sits alongside newer institutional Bitcoin-backed products such as Circle’s cirBTC.
SideSwap said a customer sent 4,000 L-BTC to its peg-out service at 14:05 UTC on Sept. 6. The service processed the request with valid authorization, burned the L-BTC and triggered a 3,996 BTC payout from the federation 23 minutes later.
According to SideSwap, Blockstream traced those L-BTC to a vulnerability in Elements, the open-source software underlying Liquid. SideSwap said its PAK and systems remained intact and that its service had no way to distinguish the affected coins from ordinary L-BTC.
The affected L-BTC appears to have been created without corresponding bitcoin backing and was later accepted through SideSwap’s normal peg-out process. Blockstream has not yet disclosed enough technical detail to establish how the Elements vulnerability created apparently valid L-BTC or which validation step failed.
The incident adds another software-level security failure to a year already marked by wallet and infrastructure bugs. One recent example was the Coldcard firmware flaw that exposed users to predictable wallet seeds.
Are the actors really white hats?
After consolidating the funds, the actors embedded an OP_RETURN message saying, “we are whitehats. contact us onchain.”
Ledger CTO Charles Guillemet questioned the label, comparing the sequence with earlier exploits where attackers moved funds first and negotiated afterward. He later acknowledged that the actors’ attempt to contact Blockstream was unusual for a conventional criminal operation.
Blockstream and the actors subsequently exchanged OP_RETURN and PGP-encrypted messages, according to Galaxy Research head Alex Thorn.
At Bitcoin block 965,869, the actors asked whether returning “most” of the funds to the federation address would be acceptable. A later message told Blockstream to fix the vulnerability and patch every Liquid node before the BTC was sent back.
The proposed return is consistent with the actors’ white-hat claim, though “most” leaves an undisclosed amount potentially retained. The actors also remain unidentified, and their intentions have not been independently verified.
As of Sept. 7, no large-scale return of the withdrawn bitcoin had been publicly confirmed, and Liquid had not released a full technical post-mortem. The network remained focused on patching affected infrastructure before normal transaction processing could resume.
Share
Most read articles
