Liquid Network Pauses After Exploit Moves Nearly 4,000 BTC

Liquid Network paused activity after nearly 4,000 BTC left the federation wallet backing L-BTC, turning a software-validation failure into one of the largest crypto infrastructure incidents of the year.

According to SideSwap's account of the transaction, a customer sent 4,000 L-BTC to its peg-out service. The tokens were burned under a valid authorization and the Liquid Federation then paid 3,996 BTC to the destination address. SideSwap said neither its systems nor its Peg-out Authorization Key was compromised.

The crucial distinction is how the L-BTC entered the redemption path. SideSwap said Blockstream determined that the tokens had been created through a bug in Elements, the software underpinning Liquid. In other words, the reported failure was not a stolen-key withdrawal: unbacked sidechain units were allegedly created and then exchanged for real BTC through an authorized process.

Liquid disabled bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals while the network remained paused. Other assets issued on Liquid were not reported as affected, and the incident did not compromise Bitcoin's base layer.

The unidentified actor described itself as a white hat and communicated with Blockstream through Bitcoin OP_RETURN messages and PGP-encrypted text. It offered to return most of the funds after the underlying vulnerability was fixed across the network. Blockstream later sent a signed onchain message stating that bridge nodes had been patched and that the funds could be returned.

At 12:35 BRT on September 7, a direct mempool.space address check still showed approximately 3,998.5 BTC sitting unmoved in the actor-controlled address. The only unconfirmed transaction was inbound dust carrying a message, not a spend from the address. A promise to return funds is not the same as recovery, and the white-hat label remains self-applied.

The lasting question is therefore broader than custody. Liquid's federation could execute a valid redemption while the asset presented for redemption was allegedly created without backing. That puts software-version discipline, reserve verification and coordinated federation patching at the center of the post-incident review.

The story remains developing. A verified return transaction, a detailed root-cause disclosure or a network-resumption notice would materially change the assessment.

Sources and disclosures

Sources: Liquid Network, Blockstream and SideSwap statements as cited by The Block; Bitquery onchain investigation; Reuters; Cointelegraph. The artwork is an illustrative editorial metaphor and does not depict actual infrastructure. The $320 million figure is a contemporaneous valuation, not a finalized loss.

Update note

Last verified September 7, 2026 at 12:35 BRT. Approximately 3,998.5 BTC remained unmoved at the latest available onchain observation; no network-resumption notice or detailed official root-cause report was located.