Liquid sidechain pauses after nearly 4,000 BTC withdrawn from federation wallet

Blockstream’s Liquid sidechain halted operations on Sunday after roughly 4,000 BTC was moved out of the federation wallet that backs L‑BTC. The withdrawal was made using a valid peg‑out authorization key, and the receiving address identified itself on‑chain as “whitehats”.

Withdrawal details

Two transactions transferred the funds. The first, confirmed in block 965780 at 14:01 UTC, sent 2.5 BTC. The second, 27 minutes later, sent 3,995.99999857 BTC to address bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte. The address now holds 3,998.49748445 BTC, valued at about $319.5 million at a BTC price of $79,901.

On‑chain message and response

Four hours after the second transfer, the address consolidated the funds and added an OP_RETURN message: “we are whitehats. contact us on chain.” The same transaction returned 1,000 satoshis to the emptied federation wallet. Blockstream replied on‑chain an hour later, sending 1,000 satoshis back with the note “Please contact [email protected].”

Network reaction

Blockstream announced the incident at 4:25 p.m. ET, stating that the funds were withdrawn via the SideSwap Peg‑out Authorization Key (PAK) and that the key was not compromised. Bridge nodes were disabled, halting new L‑BTC transactions, and exchanges were instructed to pause L‑BTC deposits and withdrawals. Other assets issued on Liquid, such as USDT and DePix, remain unaffected.

Technical context

The federation wallet is an 11‑of‑15 multisig. Peg‑outs require an authorized address and a PAK list, which can only be updated after a three‑day period, providing a window to detect compromised functionaries. SideSwap, a federation member, performed the peg‑out using its authorized key.

Additional on‑chain activity

Two hours after the white‑hat message, a third transaction sent 69,093 satoshis to the same address with the text “Please contact us on Signal @m671aw.70.” Analysts noted that the Signal request originated from a different address, and opinions differed on whether the behavior matched typical responsible disclosure.

Future outlook

Blockstream has not provided further details on the vulnerability. A roadmap published in May outlined plans for a “BitVM‑style 1‑of‑n bridge” to reduce trust in the federation, but that design is not yet live. The incident follows a recent security‑related shutdown of the Core Lightning network.