Catenaa, Monday, September 07, 2026- Liquid Network halted new transactions Sunday after hackers withdrew nearly 4,000 bitcoin, worth about $320 million, from its federation wallet.
The withdrawal removed about 95% of the approximately 4,200 bitcoin held in the wallet supporting the Bitcoin-linked settlement network.
Liquid said the people responsible claimed to be white-hat hackers, who typically identify security weaknesses and seek payment before returning withdrawn assets.
However, their identity and intentions remain unverified. Liquid has not confirmed that the bitcoin will be returned.
The network warned that Liquid wallets would be affected while federation members investigated the incident and worked to restore normal operations.
The transaction was processed through SideSwap, a settlement service authorized to handle withdrawals from the network.
Liquid said the SideSwap authorization credential used during the process had not been compromised.
That detail suggests the incident may have involved a software weakness rather than the theft of account credentials or private access information.
The attackers reportedly left an onchain message identifying themselves as white-hat hackers and inviting Blockstream to contact them.
Blockstream has attempted to establish contact through a signed onchain message, according to reports.
No agreement covering the return of the funds had been announced by Monday.
Liquid Network and Blockstream did not immediately respond to emailed requests for further comment, Bloomberg reported.
Blockstream launched Liquid in 2018 as a Bitcoin sidechain designed to offer faster settlement and greater transaction confidentiality.
The network is managed by a federation of more than 80 exchanges, infrastructure companies, asset managers and other Bitcoin-focused businesses.
Liquid allows users to lock bitcoin and receive Liquid Bitcoin, known as L-BTC, for transactions across its separate network.
Each L-BTC is intended to be backed one-to-one by bitcoin secured through the federation.
Users can later destroy their L-BTC and withdraw the corresponding bitcoin through a process known as a peg-out.
The affected federation wallet holds bitcoin supporting that arrangement.
A smaller group of federation members operates specialized servers that produce blocks and manage transfers between Liquid and the Bitcoin mainchain.
Exchanges and trading companies use Liquid to move bitcoin more quickly than transactions may settle on Bitcoin during congested periods.
Blockstream has listed BTSE, Bitfinex and BitMEX among companies that have used the network.
BitMEX has announced plans to shut down this month.
The withdrawal raises immediate questions about the bitcoin reserves supporting L-BTC currently circulating across Liquid.
The network has not said that customers permanently lost their holdings or disclosed when normal transactions could resume.
Users may be unable to move affected assets until federation members repair the weakness and safely restart operations.
Preliminary evidence points to a possible flaw that allowed unsupported L-BTC to be created, according to Aneirin Flynn, chief executive of cybersecurity company FailSafe.
Such a flaw could permit someone to generate L-BTC without first depositing matching bitcoin.
The newly created L-BTC could then be destroyed through the peg-out system to release genuine bitcoin from federation reserves.
Liquid and Blockstream have not publicly confirmed that account of the breach.
Investigators must establish how the withdrawal passed network validation and why SideSwap’s approved transfer route released the bitcoin.
They must also determine whether the flaw affects other wallets, issued assets or services connected to Liquid.
The incident places Liquid’s federated security system under renewed scrutiny.
Unlike Bitcoin’s open mining network, Liquid relies on a defined group of federation members to operate the sidechain and secure its bridge.
That structure allows faster settlement but concentrates responsibility for transfers and reserve protection among a limited number of participants.
The reported loss follows several attacks that have renewed concerns about weaknesses in cryptocurrency infrastructure.
An attacker last week drained about $6 million from a lending platform linked to Crypto.com.
An August attack involving Coldcard also raised questions about the security of offline bitcoin storage.
The Liquid incident differs because the withdrawal targeted bitcoin reserves supporting an asset issued across a federated sidechain.
Its impact will depend largely on whether the actors cooperate with Blockstream and return the funds after developers repair the vulnerability.
Recovering the bitcoin would reduce the direct financial damage but would not resolve concerns about the failure of Liquid’s transaction controls.
A permanent loss would place the incident among the largest cryptocurrency thefts reported in 2026.
Liquid must explain the technical failure, verify the status of L-BTC backing and demonstrate that affected systems are secure before reopening transactions.
