The Liquid Network, a major Bitcoin sidechain, has been paused after hackers drained roughly 4,000 BTC from its federation wallet in a $320 million theft. The breach has left L-BTC, the network's native currency, backed by only 4.7% of the bitcoin required to maintain its 1:1 peg with bitcoin.
In recent communications, attackers presenting themselves as a "white hacker" indicated they would return "the money back safely" once the bug enabling the theft is fixed. Blockstream responded affirmatively, stating that "Bridge nodes are patched, safe to return the funds." However, the attacker previously mentioned returning "most" of the money, leaving uncertainty about the full amount.
Bridge nodes have been disabled, and exchanges have been instructed to pause L-BTC deposits and withdrawals. Other assets on the network, including USDT, remain unaffected but cannot be moved.
The L-BTC Backing Problem
L-BTC is designed to be backed 1:1 by bitcoin, with 197 BTC remaining in the federation's wallet after the attack. The critical question facing the network is what will happen to L-BTC's value when the network reopens and users can resume moving funds.
Mempool.space developer Mononaut raised the possibility that if the breach resulted from an inflation bug, L-BTC may no longer maintain its original limited supply, potentially creating additional complications for holders.
Limited Public Disclosure
Despite the magnitude of the incident, the vast majority of Liquid Federation members—including Bitfinex, Boltz, Hodl Hodl, Specter, Coinshares, Komainu, Xapo, Bull Bitcoin, and Ledger—have not issued public statements about the breach or their L-BTC holdings. Blockstream CEO Adam Back, whose company created Liquid, has also not publicly commented.
The federation comprises 81 members total, with 15 running the secure infrastructure that proposes and signs blocks. At least 11 of those 15 are required to approve each block.
The scale of the impact on the broader industry remains unclear while the network awaits restart. The uncertainty extends to which party—potentially the federation itself, Blockstream, or individual L-BTC holders—may need to absorb any shortfall if the attacker does not return all stolen funds.
