Liquid Network Paused After $320 Million Bitcoin Exploit; Self-Described White Hat Offers to Return Funds

Liquid Network has paused activity after an extraordinary software failure allowed roughly 4,000 bitcoin worth approximately $320 million to leave the federation wallet backing the Bitcoin sidechain’s L-BTC asset.

Unlike many cryptocurrency breaches, the incident does not appear to have begun with stolen private keys. Liquid said the bitcoin left through SideSwap’s authorized peg-out mechanism while the relevant Peg-out Authorization Key remained secure. SideSwap separately said Blockstream determined that a vulnerability in the Elements software underlying Liquid allowed L-BTC to be created that was not properly backed by bitcoin.

Liquid is designed to let users move bitcoin onto a federated sidechain. Bitcoin deposited into the system backs L-BTC, which can later be destroyed through a peg-out process that releases bitcoin from the federation wallet. In normal operation, circulating L-BTC should correspond to bitcoin held behind the peg.

SideSwap said a customer sent 4,000 L-BTC to its peg-out service on September 6. The system processed the request like an ordinary redemption, burned the L-BTC using a valid authorization and then caused the federation to transfer approximately 3,996 BTC to the requester’s Bitcoin address.

SideSwap said its systems and authorization key were not compromised. Instead, it said Blockstream determined that the L-BTC entering the peg-out had originated through a software vulnerability in Elements. That meant the downstream settlement process was presented with assets that appeared legitimate even though sufficient bitcoin had never entered the federation to back them.

The financial effect was severe. The federation reportedly held roughly 4,200 BTC before the incident, so the withdrawal represented about 95% of the reported reserve. Liquid disabled bridge nodes, paused activity and asked exchanges to suspend L-BTC deposits and withdrawals while federation members investigated and patched the infrastructure.

The event does not mean Bitcoin itself was hacked. Bitcoin’s base-layer consensus network continued operating normally. The failure occurred in the federated sidechain software and validation mechanisms used by Liquid and its Elements stack.

The identity and motives of the party controlling the funds remain uncertain. An on-chain message described the party as a white hat and asked Blockstream to communicate through the Bitcoin blockchain. That claim has not been independently established.

On September 7, the party said it would return most of the bitcoin once the underlying vulnerability was fixed and relevant nodes were patched. Blockstream subsequently sent a signed message indicating that bridge nodes had been patched and the funds could be returned. At the latest update used for this article, the approximately 4,000 BTC had not yet returned to the federation.

Two questions remain unresolved. First, how much bitcoin will ultimately be returned? Second, what exact Elements flaw allowed unbacked L-BTC to become valid enough to pass through the normal redemption path?

The incident exposes a failure mode different from a stolen exchange wallet. Cryptographic systems can protect keys perfectly and still produce a bad outcome if the software deciding what those keys are being asked to sign has already accepted an invalid state.

For institutional users of blockchain infrastructure, the lesson is broader than Liquid. Security controls must protect not only keys and signing devices but also asset-accounting logic, validation state, bridges and the software that determines whether a withdrawal is legitimate.

If the funds are returned, the incident could become one of the largest white-hat recoveries in cryptocurrency history. If they are not, Liquid will face a much harder question about how a sidechain lost nearly its entire reported Bitcoin reserve through a transaction path that looked valid to the system.

Either way, the security significance is already clear: this was not simply a stolen password. It was a failure in the machinery that decides whether digital money is real.