Liquid Network recovers 3,400 BTC after a $320M sidechain incident

The Block reported that Liquid Network recovered 3,400 BTC after a large withdrawal from its federation wallet. The incident began on September 6, when actors calling themselves white-hat hackers withdrew roughly 4,000 BTC, worth about $320M at the time.

Liquid is a Bitcoin sidechain. BTC locked on Bitcoin is represented on Liquid as L-BTC. Federation operators secure the underlying Bitcoin. When the incident began, the federation wallet held about 4,200 BTC, so the withdrawal touched roughly 95% of reported reserves.

How the withdrawal worked

The funds left through SideSwap’s Peg-out Authorization Key, or PAK. Liquid said the key was not compromised. SideSwap also said its systems were not breached.

According to The Block, a user sent 4,000 L-BTC to SideSwap’s peg-out service. The service burned those tokens with a valid peg-out authorization. The Liquid Federation then paid 3,996 BTC to the customer’s Bitcoin address.

SideSwap later said Blockstream traced the source to a bug in Elements, the software behind Liquid. That means the attackers allegedly created L-BTC, which should not have existed, then used a normal peg-out path to convert those tokens into BTC.

What changed after the patch

The actors communicated with Blockstream through Bitcoin OP_RETURN messages and PGP-encrypted text. In one message, they told Blockstream to fix the bug first and ensure every node was patched before returning funds.

Blockstream then sent a PGP-signed on-chain message saying the bridge nodes were patched and funds were safe to return. The attacker returned 3,400 BTC to the federation address in Bitcoin block 965,950.

• Original withdrawal: about 4,000 BTC.
• Returned amount: 3,400 BTC.
• Remaining amount: about 598.5 BTC.
• Estimated value still outside the wallet: about $47M.

Impact for users

Liquid paused network activity after the withdrawal. Bridge nodes were disabled, so new transactions stopped. Exchanges were told to suspend L-BTC deposits and withdrawals.

Reuters reported that Liquid wallets were affected by the halt. Liquid said other issued assets, including USDT, DePix, and real-world assets on the network, were not directly affected by the security incident.

The practical issue is trust in the backing model. L-BTC depends on bitcoin reserves held by the federation. A bug that lets invalid L-BTC pass through a valid peg-out path turns a software flaw into a reserve-risk event.