Liquid Sidechain Halts After White Hats Withdraw $320M in BTC

Liquid, the Bitcoin sidechain operated by Blockstream, has paused operations after actors who claim they are “white-hat” hackers withdrew roughly 4,000 BTC from Liquid’s federation wallet—an amount the report describes as worth about $320 million. The move has triggered a wider shutdown of bridge activity, with Liquid saying new transactions are currently blocked.

On Sunday, Liquid said it disabled bridge nodes, halting activity that would otherwise allow users to move funds between Bitcoin and Liquid’s network. Exchanges, meanwhile, were either already stopping deposits and withdrawals of L-BTC or preparing to do so, according to Liquid’s public statements.

Key takeaways

• Liquid disabled bridge nodes after actors withdrew about 4,000 BTC from the federation wallet, leaving the sidechain in a paused state.
• Liquid and Blockstream say they contacted the actors through signed on-chain messages seeking a remediation and coordinated return of funds.
• Liquid estimates the withdrawn BTC represented about 95% of the wallet’s roughly 4,200 BTC balance at the time of the incident.
• L-BTC bridge-related activity was stopped, while Liquid says other issued assets on the network—including USDT—were not affected.
• SideSwap says its peg-out service processed a withdrawal order using its PAK and that the key was not compromised, attributing the source of the L-BTC to a bug in Elements.

Bridge nodes disabled as federation wallet is emptied

Liquid’s response centers on preventing further bridge transactions while the federation works through the situation. Liquid stated that bridge nodes were turned off, which stops new transactions from being created or relayed through the bridge.

The immediate market-facing impact was felt by custodians and exchanges supporting L-BTC. Liquid said exchanges had halted or were in the process of halting L-BTC deposits and withdrawals—effectively reducing the risk of users interacting with a bridge that is no longer operating normally.

Liquid said the seized Bitcoin amount was taken from its federation wallet. The report notes that the withdrawn BTC accounted for approximately 95% of a federation balance that was around 4,200 BTC prior to the incident.

On-chain messages and a demand to patch before funds return

Blockstream, Liquid’s technology provider, reportedly began contacting the actors directly using signed on-chain messages. Subsequent messages, as described in the reporting, show the actors telling Blockstream to patch the vulnerability and ensure that every node is updated before they would return most of the Bitcoin.

The actors also reportedly provided encrypted technical details to Blockstream. According to Galaxy Digital research head Alex Thorn, those details were shared through the same channel of communications.

As of the time of writing, the funds had not been returned, leaving the sidechain paused and raising an open question for Liquid users: even if the actors’ stated intent is to improve security, the operational downtime could persist until updates are verified across the network.

Other Liquid-issued assets reportedly unaffected

Liquid said other assets issued on the network were unaffected. That includes tokens and instruments such as USDT, DePix, and real-world assets (as referenced in the report). The sidechain’s pause appears focused on bridge functionality and the federation wallet state, rather than a broader halt of every on-chain activity.

For traders and integrators, this distinction matters. When a sidechain pauses because of bridge-layer issues, it can limit the ability to move assets in or out, but it may still allow certain on-network transfers—depending on the specific operational constraints put in place by the federation and bridge nodes.

SideSwap attributes peg-out details to Elements, not its system

One of the most specific parts of the incident response came from SideSwap, which said the withdrawal passed through its peg-out service as a customer order using its Peg-out Authorization Key (PAK). SideSwap emphasized that the PAK was not compromised.

The company’s statement further claims that the L-BTC used in the transaction originated from a bug in Elements—the open-source software that underpins Liquid—rather than from a compromise or failure within SideSwap’s systems.

That framing is significant because it shifts attention from custodian or peg-out authorization credentials toward the base protocol layer. If the vulnerability truly stems from Elements behavior, the remediation would likely require coordinated updates not only on the bridge or federation components, but also across the surrounding software stack that interfaces with Liquid nodes.

What to watch next for Liquid users and integrators

Until Liquid and Blockstream complete the patching and federation-wide node updates demanded in the messages, the bridge will remain paused and L-BTC flows are likely to stay constrained. Users should monitor further public updates from Liquid and Blockstream—especially any confirmation that the patched version is fully propagated across nodes and that exchanges resume deposits and withdrawals safely.