Bitcoin: Liquid Network Suspends Its Network After 4,000 BTC Are Withdrawn

Nearly 4,000 BTC, worth approximately $320 million, left Liquid Network’s federated wallet on Sunday. In an official message published on September 6, Liquid confirmed a security incident and said it had temporarily suspended its network. Those behind the transfers describe themselves as “whitehats,” but their identities and the exploited vulnerability remain unknown.

Bitcoin: Nearly 95% of the Reserve Moved

The first transfer moved approximately 3,996 BTC to a new address, reducing Liquid’s visible reserves from around 4,200 BTC to just over 200 BTC. The incident has once again highlighted the risks associated with bridges and infrastructure connecting different blockchains.

A few hours later, almost all of the affected bitcoin was transferred again. This second transaction contained a message recorded directly on Bitcoin via OP_RETURN: “we are whitehats. contact us on chain”.

In other words, those currently controlling the funds claim to be acting as security researchers and are inviting Liquid to contact them on the blockchain. That is obviously not enough to establish their intentions.

Liquid said the withdrawal went through SideSwap’s Peg-out Authorization Key (PAK). Importantly, according to the network, this key was not compromised, nor were the other PAKs. The technical cause that made the operation possible has therefore not yet been made public.

Blockstream is now attempting to contact those responsible.

Liquid’s Federated Model at the Center of the Questions

Liquid does not use the same security model as Bitcoin.

The sidechain relies on a federation of companies that produces its blocks and secures the BTC used to back Liquid Bitcoin, or LBTC. Liquid’s official documentation states that a group of 15 functionaries is involved in managing this reserve.

The BTC are normally protected by an 11-of-15 multisignature wallet. A peg-out involves destroying LBTC on Liquid before releasing the corresponding amount of BTC on Bitcoin.

This mechanism adds an essential nuance to the situation: the movement of 4,000 BTC does not automatically mean that 4,000 LBTC have suddenly been left without backing. The available data suggests that the LBTC corresponding to the peg-out were indeed removed on the Liquid side.

The question instead concerns how an operation of this scale was authorized.

This distinction between the protocol and key-management systems also matters in other incidents. The recent Coldcard vulnerability, for example, concerned the generation of certain keys, not the operation of the Bitcoin protocol itself.

Bitcoin Continues to Operate, While Liquid Is Halted

Liquid has since temporarily disabled its bridge nodes. New transactions can no longer be submitted normally, and several exchanges have suspended LBTC deposits and withdrawals.

“Indeed, the Liquid sidechain is paused until the issue is resolved,” the network acknowledged.

Other assets issued on Liquid, including USDT, DePix and various tokenized assets, are reportedly not directly affected by the incident. Their users are nevertheless affected by the network interruption.

The most important point in this story is that Bitcoin itself has not been compromised. The nearly 4,000 BTC were moved using mechanisms surrounding a sidechain built around Bitcoin. The main network, meanwhile, continues to produce blocks normally.

This is a fundamental architectural difference. Liquid trades part of Bitcoin’s decentralization for faster blocks, confidential transactions and the ability to issue other assets.

The incident does not yet prove that a hacker broke this model. Liquid has only stated that a security incident occurred and is still investigating its cause. It does, however, show why it is important to distinguish a base blockchain from the infrastructure built around it. Ravencoin’s recent consensus vulnerability, by contrast, directly affected the network’s rules.

For Liquid, the next few hours will therefore be decisive: identifying the mechanism used, recovering or securing the BTC, and explaining how nearly 95% of the reserve was able to leave in a single sequence.