Key Takeaways
Nearly 4,000 bitcoin, worth about $320 million, left the Liquid Network federation wallet on September 6, cutting the sidechain's reserve from roughly 4,200 BTC to about 207 BTC.
The bitcoin moved through the SideSwap peg-out authorization key, which Blockstream says was not compromised, leaving the cause of the Liquid Network drain unexplained.
An on-chain message read "we are whitehats," no one has confirmed the actors' intent, and the sidechain is paused until the issue is resolved.
Nearly 4,000 bitcoin worth roughly $320 million moved out of the Liquid Network's federation wallet on Sunday, September 6, according to Bitcoin.com News, in one of the largest and strangest security incidents to hit a Bitcoin sidechain.
On-chain researcher Ergo BTC flagged two linked transactions, including a peg-out of about 4,000 BTC from a pool of roughly 4,200. A follow-up transaction spent close to 3,998.5 BTC and carried a message reading "we are whitehats. contact us on chain." Blockstream's Liquid explorer then showed federation holdings of just 207.275 BTC, about 95 percent below where they had sat for months.
The move drew attention because Liquid's peg-out system is not designed to let anyone simply pull bitcoin off the chain. L-BTC is destroyed on Liquid before the federation processes a matching withdrawal, mainchain funds require an 11-of-15 federation multisignature, and the peg-out authorization key is meant to restrict payments to approved member wallets.
Blockstream's Liquid Network confirmed the incident on its official account, saying the funds left through the SideSwap peg-out authorization key.
"but that key was not compromised, nor were any others"
Liquid Network, Blockstream
The team said exchanges were notified and have paused L-BTC deposits and withdrawals, while other Liquid assets such as USDT, DePix, and real-world-asset tokens are unaffected. Bridge nodes were temporarily disabled, effectively pausing the sidechain. The most notable part is that a peg built to move bitcoin safely between chains lost most of its reserve without anyone able to say yet how.
The incident lands in a year already marked by broken crypto plumbing, from the bridge exodus that followed April's Kelp exploit, covered in WYDE's report on BitGo moving $7.3 billion of wrapped bitcoin off LayerZero, to the push by institutions to build controlled rails like the bank-owned BankChain Alliance. Whether the Liquid funds come back, and how they left, is worth watching.
People Also Ask
What is the Liquid Network?
Liquid is a Bitcoin sidechain built by Blockstream where bitcoin is locked and represented as L-BTC for faster and more private transfers, run by a federation of members rather than open mining.
How much bitcoin was drained from the Liquid Network?
Nearly 4,000 BTC, about $320 million, left the network on September 6, 2026, roughly 95 percent of the federation reserve, which fell from about 4,200 BTC to 207 BTC.
It is a control in Liquid's design meant to restrict bitcoin withdrawals to approved member wallets, one of the safeguards on moving funds off the sidechain and back to the main Bitcoin chain.
Is the Liquid Network safe to use right now?
The sidechain is paused, bridge nodes are disabled, and L-BTC deposits and withdrawals are halted on exchanges while Blockstream investigates, though it says other Liquid assets are unaffected.
Sources: Bitcoin.com News, Blockstream's Liquid Network (official statement), Blockstream Liquid explorer.