Liquid Network Paused After Self-Described White Hats Drain About 4,000 Bitcoin
Blockstream’s Liquid Network, a bitcoin sidechain used by exchanges and traders to move funds quickly, was effectively frozen on Sunday after nearly all of the bitcoin backing it was withdrawn to a single address. The roughly 4,000 BTC, worth about $320 million, left the federation’s reserve wallet in what looked like a valid peg-out transaction, and the address that received it then broadcast a message on the blockchain: “we are whitehats. contact us on chain.”
As of early Monday, there was no confirmation that the coins had been returned, the sidechain’s bridge was disabled, and holders of L-BTC, the token on Liquid that is meant to be redeemable one-for-one for bitcoin, had no way to redeem it.
What happened
Liquid is a federated sidechain launched by Blockstream in 2018. Users send bitcoin into a reserve controlled by the federation and receive L-BTC on Liquid, where transactions settle faster and can hide amounts. To move bitcoin back out, a peg-out must be signed by 11 of the federation’s 15 members.
According to Bitcoin Magazine, a peg-out transaction moved 4,019.4 BTC from the reserve. Blockstream’s proof-of-reserves page showed the treasury holding more than 4,200 BTC before the withdrawal and a little over 207 BTC after it, meaning roughly 95% of the backing was gone.
The withdrawal went through SideSwap, a bridge exchange and federation member, using its Peg-out Authorization Key. Liquid said on its status page that the funds were withdrawn via that key but that neither it nor any other key was compromised. CoinDesk reported that Blockstream traced the problem to a software bug in Elements, the code that runs Liquid, which allowed some L-BTC to be created that should not have existed. SideSwap could not distinguish those coins from genuine ones and processed them normally. Security specialists quoted by CoinDesk placed the flaw in Liquid’s node software rather than in keys or hardware security modules.
That distinction matters. The federation’s signers appear to have approved a transaction their systems judged valid. The weakness was in the rules that decided what was valid, not in the custody of the keys.
The hackers’ messages
The party holding the coins has communicated only through data embedded in bitcoin transactions. Beyond the initial “whitehats” note, messages reported by CoinDesk read: “Please fix the bug first. The chain is under risk at latest commit right now,” and “Make sure every node is patched.” The sender said it would “transfer the money back safely after confirming the fix.”
Liquid said the Blockstream team was trying to reach the holders on-chain with a signed message. Whether the funds come back, and on what terms, is unknown. Self-described white hats in past exploits have sometimes returned most of the money while keeping a portion as a bounty, and some have not returned it at all. Some observers have questioned whether draining a reserve and then asking for contact fits the usual definition of responsible disclosure.
Network paused, exchanges halt L-BTC
Liquid disabled its bridge nodes, which effectively paused the sidechain, and told exchanges to suspend L-BTC deposits and withdrawals. “Liquid wallets will be impacted, and we’re sorry for any inconvenience,” the network said on X, adding that federation members were “actively working on resolving this so we can restore normal network activity.” No timeline for reopening has been given.
Other assets issued on Liquid, including USDT, the Brazilian stablecoin DePix and tokenized real-world assets, are unaffected, according to Liquid. Samson Mow, CEO of JAN3, said Liquid features in the Aqua wallet were affected but on-chain bitcoin still worked. It is not clear how much L-BTC is held by retail users versus Blockstream and institutional members.
Why it matters
Liquid is one of the oldest bitcoin scaling and settlement projects, and its federation of more than 80 members includes exchanges, infrastructure firms and asset managers. Its pitch has always rested on the idea that a known group of reputable signers is a safe custodian for bitcoin held in reserve. This incident did not break that custody model in the way a key theft would, but it shows that a federation is only as safe as the software its signers trust.
It also lands in a difficult stretch for crypto security. About a week earlier, Cronos validators halted and rolled back their chain after a price-manipulation exploit on the Tectonic lending protocol, and an exploit affecting Coldcard hardware wallets that surfaced in early August drained more than $100 million in bitcoin, according to blockchain analytics firms. For bitcoin holders in particular, the Liquid drain is a reminder that wrapped or bridged versions of BTC carry risks the base chain does not.
The next steps are a patched release for every federation node, contact with the holders of the drained coins, and an account from Blockstream of exactly how the bug worked and how much L-BTC was improperly created. Until then, L-BTC holders are waiting to learn whether their tokens are still fully backed.