Roughly 4,000 BTC, valued at approximately $320 million, was withdrawn from Blockstream's Liquid Federation wallet following a security incident on Sunday afternoon.
The unauthorized transaction was signed by 11 of the federation's 15 keys, despite the Liquid Bitcoin tokens used to redeem the BTC having questionable origins. An attacker's address retained 3,998 BTC by Monday morning and posted an on-chain message indicating they were "whitehats" seeking contact.
Network Response and Operational Impact
Liquid Network confirmed the incident shortly after 4:25pm New York time, stating that "the Liquid sidechain is paused until this issue is resolved." Bridge nodes were disabled and exchanges suspended LBTC deposits and withdrawals.
SideSwap, the peg-out service that processed the transaction, attributed the incident to faulty Liquid Bitcoin originating from a third-party "Elements bug," denying responsibility for any SideSwap system failure.
Technical Details of the Breach
All 83 inputs to the drain transaction were spent using exactly 11 valid signatures from the federation's 11-of-15 arrangement. The network's emergency safeguard—which requires two of three backup keys plus roughly 56 days of waiting—was entirely bypassed.
The attacker used a regular peg-out request through SideSwap's authorization key. Liquid Network stated this key "was not compromised, nor were any others."
Bitcoin Core contributor Antoine Poinsot noted that Liquid block 4,050,336, which contained the peg-out transaction, was rejected by Mempool.space but accepted by Blockstream, highlighting a divergence in validation standards.
Questions About Codebase Maintenance
Casa security chief Jameson Lopp observed that "the Liquid functionary codebase hasn't been touched in two years." The public repository for this code last received a commit on April 19, 2024.
Elements, the open-source Bitcoin Core fork maintained largely by Blockstream and used to run the PAK check, received a series of validation fixes in early September. One commit from September 1 addressed an issue where "a dynafed header with a mismatched height could be accepted."
Dashboard Discrepancies
Mempool.space, a Liquid federation member, logged an unauthorized 4,019 BTC withdrawal in its real-time audit of federation holdings. The official Liquid.net dashboard did not immediately reflect the loss, though Mempool.space's Liquid.network tool showed the discrepancy promptly. The two dashboards had previously diverged in January 2023.
