The Liquid Network acknowledged a security breach on Sunday, September 6, after nearly 4,000 BTC, valued at approximately $320 million, were taken from the Bitcoin wallet of the Liquid Federation. According to the federation, the peg-out was not authorized in the normal way.
The party behind the transfer left an on-chain message via an OP_RETURN reading “we are whitehats. contact us on chain” in Bitcoin transaction “c103de…e69a19.” In a post on X, Liquid stated that “purported white-hat hackers” had withdrawn the coins and that Blockstream was trying to contact them on-chain with a signed message.
ErgoBTC identified the large Bitcoin payout as transaction “8db751…a7b140,” which sent roughly 3,996 BTC to address “bc1qgs…c6wt7p” and was confirmed in Bitcoin block 965,783 at 14:28:56 UTC on September 6. On the side of Liquid, Blockstream’s explorer showed an associated transaction involving a 3,996.01834922-LBTC peg-out.
Liquid stated that the withdrawal employed SideSwap’s peg-out authorization key (PAK), even though the SideSwap PAK itself was not breached. Liquid uses a two-way peg between Bitcoin and its sidechain, where users lock BTC to mint Liquid Bitcoin (LBTC) and burn LBTC to release the underlying Bitcoin. Peg-outs are gated by a Peg-out Authorization Key designed to prevent functionaries from redirecting user funds to attacker-controlled addresses even if compromised. The present evidence does not indicate any issue with Bitcoin itself.
Until the funds are returned, the designation of the actors as white hats remains a claim rather than a fact. Furthermore, there is currently no cited evidence that the funds have reached exchanges, meaning selling pressure cannot be assumed simply from the on-chain movement.
The incident places renewed focus on the security and trust surrounding federated bridges. According to TRM Labs, infrastructure and operational vulnerabilities accounted for roughly 15% of incidents in the first half of 2026, but represented 76% of total losses in monetary terms, highlighting the heavy impact of custody and bridge disruptions.
