Bitcoin sidechain Liquid has paused operations after the federation that governs the network lost roughly 4,000 BTC worth about $320 million to actors who claimed they were “white-hat” hackers. Liquid’s operators disabled bridge nodes and moved to stop L-BTC deposits and withdrawals, while stressing that other Liquid-issued assets were not affected.

Blockstream, the technology provider behind Liquid, said it corresponded with the actors through signed on-chain messages. The actors told Blockstream they would return most of the Bitcoin after the underlying vulnerability was fixed and every node installed the patch—though, at the time of publication, the funds had not yet been returned.

Key takeaways

Liquid disabled bridge nodes and halted new bridge transactions after about 4,000 BTC was withdrawn from its federation wallet.
L-BTC deposit and withdrawal processing was halted or expected to be halted by exchanges, while other Liquid-issued assets reportedly continued without interruption.
About 95% of the federation wallet’s roughly 4,200 BTC balance was reportedly moved to the actors.
Blockstream says it communicated with the actors via signed on-chain messages, and the actors promised a return after patching and node updates.

Liquid pauses bridging as federation funds are pulled

Liquid said on Sunday that bridge nodes were disabled, preventing new transactions. It also indicated that exchanges were either halting or preparing to halt L-BTC deposits and withdrawals, reflecting the sidechain’s need to maintain custody and accounting for its pegged token.

Liquid emphasized that other assets issued on the network—such as USDT, DePix, and tokenized real-world assets—were unaffected by the incident. That distinction matters for users holding non-LBTC assets on Liquid, because it suggests the disruption is centered on the bridge and federation-controlled Bitcoin backing rather than on a broad contract or issuance failure across the sidechain.

The federation wallet withdrawal is described as roughly 95% of the federation’s approximately 4,200 BTC balance. Liquid uses Bitcoin held by its federation to back L-BTC issued on the sidechain. As a result, most of the Bitcoin backing remained under the actors’ control until it is returned, creating a direct liquidity and settlement problem for L-BTC as bridging is paused.

Negotiations via on-chain contact and PGP messaging

According to Blockstream’s reported engagement with the actors, communication took place through signed on-chain messages. Public details of the exchange were later compiled by Samson Mow, CEO of Jan3 and a former Blockstream chief strategy officer, who pointed to a timeline embedded in Bitcoin transactions.

In that account, the actors identified themselves as “white hats” and requested on-chain contact at around 11:30 a.m. Pacific time. Blockstream reportedly responded about an hour later, directing them to its security email. It then allegedly sent a PGP-encrypted message after further correspondence.

Later, the actors reportedly asked whether they could return most of the Bitcoin to a Blockstream address. They also demanded that the vulnerability be fixed and that every node update before the return transfer would occur. Blockstream’s reply—described as acknowledging the address question—was presented publicly by Mow, with the implication that Blockstream agreed to receive the funds at the designated location while also treating patching as a key prerequisite.

By one account relayed publicly, no additional messages were seen after roughly 9:12 p.m. Pacific time, and at the time of writing, the Bitcoin had not been returned.

Technical attribution: Elements bug vs. exchange systems

One issue raised in public discussion is where the exploited flaw originated. SideSwap—connected to peg-out operations—said the withdrawal went through its peg-out service as a customer order using its Peg-out Authorization Key (PAK), but it asserted that the key itself was not compromised.

SideSwap added that the L-BTC used in the transaction traced back to a bug in Elements, the open-source software underlying Liquid, rather than originating from SideSwap’s own systems. For participants watching the fallout, this distinction can affect how quickly exchanges and service providers can operationally reassure users: a failure rooted in underlying Liquid/Elements code generally requires broad patching at the protocol layer, while a failure tied to an exchange-specific signing component would typically be resolved by rotating or securing that component.

Liquid’s decision to disable bridge nodes and coordinate L-BTC deposit/withdrawal freezes aligns with the practical need to stop flows that depend on the federation-controlled Bitcoin backing while technical remediation is verified across the network.

What investors and users should monitor next

The immediate risk from this event is settlement and liquidity disruption for L-BTC, not necessarily for every Liquid-issued token. The key question now is whether the actors follow through on their stated plan to return most of the Bitcoin once a patch is confirmed and every node has updated.

Readers should watch for confirmations from Liquid and Blockstream that the patch is deployed across all nodes, that bridge nodes are restored, and—most importantly—that the returned funds actually reach the federation wallet. Until then, the sidechain’s peg mechanics remain constrained by the absence of the withdrawn Bitcoin backing.