Bitcoin Layer 2 network Liquid Network experienced a security incident in which purported white-hat hackers withdrew approximately 4,000 BTC, valued at $320 million, from the Liquid Federation wallet.
The funds were withdrawn using the SideSwap PAK (Peg-out Authorization Key), though Liquid stated the key itself was not compromised and no other keys were at risk. Liquid confirmed that other assets on the network, including USDT, DePix, and real-world assets, were not affected.
Blockstream, which operates Liquid, has temporarily disabled bridge nodes, effectively pausing the sidechain while the issue is being addressed. Crypto exchanges have been notified and are suspending LBTC deposits and withdrawals.
Communication On-Chain
Blockstream has attempted to contact the parties involved through signed on-chain messages. The alleged hacker began communication at 11:30 AM PDT on September 6, stating "we are whitehats. contact us on chain." Blockstream responded and offered contact via email and encrypted PGP-signed messages.
The parties continued exchanging messages using Bitcoin transaction data. At 7:20 PM, the hacker indicated plans to send most funds back and asked if a specified address was acceptable. About an hour later, they stated the bug must be fixed first, saying "The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix." Blockstream responded "Yes, thank you" at 8:30 PM.
Skepticism Over White-Hat Claims
Security experts have questioned the legitimacy of the white-hat designation. Ledger CTO Charles Guillemet noted that legitimate security researchers do not typically drain bridges and request on-chain contact. He drew comparisons to the Ronin hack, where attackers stole approximately $625 million after compromising validator keys, and the Euler exploit, where perpetrators negotiated after stealing funds.
As of 9:12 PM PDT, approximately 3,998.5 BTC remained unmoved, with no further messages exchanged between the parties.
