Liquid sidechain halts after alleged white‑hat withdrawal of 4,000 BTC

Liquid, the Bitcoin sidechain operated by Blockstream, announced a pause of all bridge‑node activity after actors identifying themselves as white‑hat hackers withdrew approximately 4,000 BTC (about $320 million) from its federation wallet.

Operational impact

Bridge nodes were disabled, stopping new transactions. Several exchanges either halted or prepared to halt L‑BTC deposits and withdrawals. The withdrawal represented roughly 95 % of the wallet’s pre‑incident balance of about 4,200 BTC.

Response from Blockstream and Liquid

Blockstream began communicating with the actors via signed on‑chain messages. The actors indicated they would return most of the Bitcoin once the Elements vulnerability—affecting the open‑source software that underpins Liquid—was patched across the network and all nodes were updated. Encrypted technical details were reportedly sent to Blockstream.

Role of SideSwap

SideSwap confirmed that the transaction passed through its peg‑out service using a Peg‑out Authorization Key (PAK). The service stated the key was not compromised and that the L‑BTC used in the transaction originated from the Elements bug, not from SideSwap’s systems.

Other assets on the network

Liquid said assets other than Bitcoin, including USDT, DePix and other real‑world tokens, were not affected by the incident.

Next steps

The federation members are working to fix the vulnerability before any return of the withdrawn funds. The situation remains under development.