Liquid Network Halts After 4,000 BTC Worth $320M Pulled From Federation Wallet

4,000 BTC Leaves Liquid Reserves

Liquid Network, the federation-governed Bitcoin sidechain developed by Blockstream, has been effectively halted after roughly 4,000 BTC — about $320 million — was withdrawn from the Federation's reserve wallet over the weekend, according to the protocol's own security announcement on September 6. The party that moved the funds describes itself as a white hat, though the network has so far used only cautious language on that claim. On-chain and official timelines show the funds exited through a peg-out authorized under SideSwap's Peg-out Authorization Key (PAK): at 14:05 UTC on September 6, a customer sent 4,000 L-BTC to SideSwap's peg-out service, the L-BTC was burned as in a routine redemption, and at 14:28 UTC a total of 3,996 BTC was paid out to a Bitcoin address. SideSwap says it processed the request like any normal order and could not distinguish the incoming L-BTC from genuine units. Blockstream subsequently informed SideSwap that the L-BTC in question had been created through a defect in Elements, the underlying Liquid software — meaning unbacked tokens apparently passed a regular peg-out path. Officials state there is no evidence the PAK or any other key was compromised. The withdrawn sum equals roughly 95% of the approximately 4,200 BTC held in Liquid reserves before the incident. In response, the network disabled its bridge nodes, leaving new transactions unable to propagate, and asked exchanges and service operators to suspend L-BTC deposits and withdrawals. Issued assets on the sidechain — USDt, DePix and tokenized real-world assets — are described as unaffected, though the shutdown restricts all on-chain transfers. Bitcoin's mainnet itself shows no sign of compromise: Liquid runs under an independent security model, and this is a sidechain failure, not a Bitcoin protocol breach.

White Hat Claim Meets Skepticism

The self-described white hat framing has drawn pushback from security figures close to the ecosystem. Charles Guillemet, CTO of hardware wallet maker Ledger, questioned the label: a genuine white hat does not typically drain a bridge first and then request on-chain contact. He noted, however, that criminal groups almost never initiate contact with victims either, leaving open the possibility of well-meaning actors unfamiliar with responsible disclosure — perhaps even people experimenting with recent LLM tooling. Guillemet also flagged the resemblance to the 2022 Ronin Network breach, in which validator keys were compromised and roughly $625 million taken, though Blockstream explicitly denies any key compromise here, so the two incidents diverge at the root-cause level. On-chain, the claiming party left a message stating the funds will be returned once the bug fix is verified; as of September 7, no return to the Federation has been confirmed. Blockstream's team is attempting contact through signed on-chain messages. Samson Mow, founder and CEO of JAN3, said work on the ongoing incident is underway and that his Aqua wallet's Liquid-related features are affected, while Bitcoin transactions proceed normally. Aoji Higashi, Blockstream's Japan ambassador, pointed out that Liquid reserves sit under multi-signature control across multiple operators, making a scenario of stolen keys and a single bulk transfer hard to explain — the likelier open question is how a legitimate-looking peg-out cleared at all. Officials have not disclosed the specific class of the Elements bug, and no final technical report exists yet. The peg between L-BTC and Bitcoin is effectively frozen, and Bitcoin DeFi services built on Liquid face operational uncertainty until the chain restarts. Readers tracking the market in real time can follow live spot and futures prices on Binance.

Elements Bug, Not Keys

COINOTAG's read of the primary evidence: the withdrawal and the claimant's on-chain message are both independently verifiable on-chain, and neither Blockstream nor Liquid has yet published the root-cause post-mortem that would settle how unbacked L-BTC was minted. What the official statements do establish is the remediation path — bridge nodes disabled, exchange deposits and withdrawals suspended — and a root cause located in the Elements software rather than in key custody. The broader lesson for the wallet user is structural: a federated sidechain, even with multi-sig spread across operators, remains a distinct trust domain where a software defect can mint unbacked units — a failure mode distinct from both Bitcoin's base layer and rollup bridges on Ethereum. Liquid also hosts issued assets far smaller than the yield farming economies on other chains, but confidence in its restart now hinges on a published technical report and verified fund return.