Liquid sidechain pauses after $320 million Bitcoin withdrawal by alleged white‑hat hackers

Liquid sidechain halts after $320 million Bitcoin withdrawal

The Liquid network, a Bitcoin sidechain, stopped processing new transactions on Sunday after actors who said they were white‑hat hackers moved roughly 4,000 BTC worth about $320 million from the network’s federation wallet.

Key facts

• Withdrawal amount: ~4,000 BTC (~$320 M), about 95 % of the wallet’s ~4,200 BTC balance.
• Liquid disabled its bridge nodes, pausing new L‑BTC deposits and withdrawals.
• Other assets on Liquid (USDT, DePix, real‑world assets) continued to work.
• Blockstream, the technology provider for Liquid, contacted the actors via signed on‑chain messages.
• The actors said they would return most of the Bitcoin after an Elements vulnerability is patched and every node updates.
• SideSwap confirmed the withdrawal passed through its peg‑out service but said its key was not compromised.

Liquid’s announcement

Liquid posted on X (formerly Twitter) that bridge nodes were disabled, preventing new transactions, and that exchanges were halting or preparing to halt L‑BTC deposits and withdrawals.

Blockstream and white‑hat communication

Blockstream responded to the actors’ on‑chain request about an hour later, directing them to a security email and sending a PGP‑encrypted message. The actors later asked to return most of the Bitcoin to a Blockstream address, but only after the vulnerability was fixed and every node installed the patch. Blockstream replied “Yes, thank you,” addressing the return‑address question.

Confirmed details

• The withdrawal represented roughly 95 % of the federation wallet’s Bitcoin holdings.
• Liquid’s federation wallet backs L‑BTC, the token issued on the sidechain.
• SideSwap’s peg‑out service was used, but its security key was not compromised.
• Blockstream and the actors exchanged signed on‑chain messages confirming the plan to return the funds after a patch.

Open questions

• Whether and when the actors will actually return the Bitcoin.
• The exact timeline for patching the Elements vulnerability across all Liquid nodes.
• Potential impact on L‑BTC users if the funds are not returned promptly.

Implications for L‑BTC users

L‑BTC is a token that represents Bitcoin held in Liquid’s federation wallet. With most of that Bitcoin under the actors’ control, users cannot move or redeem L‑BTC until the issue is resolved.

Next steps

Blockstream is working on a patch for the Elements software. The actors have said they will return most of the Bitcoin after the patch is applied and every node is updated, but no specific timeline has been given.

Sources

• Cointelegraph