Bitcoin sidechain Liquid has suspended operations following the withdrawal of approximately 4,000 Bitcoin — valued at roughly $320 million — from its federation wallet by actors claiming to be white-hat hackers. The incident, disclosed on Sunday, prompted Liquid to disable bridge nodes and halt new transactions while exchanges paused or prepared to pause L-BTC deposits and withdrawals.
Blockstream engages with actors claiming white-hat status
Blockstream, the technology provider behind Liquid, initiated contact with the actors through signed onchain messages. According to subsequent communications, the individuals stated they would return the majority of the Bitcoin once the vulnerability in Elements — the open-source software underpinning Liquid — is patched and all network nodes are updated. They also sent encrypted technical details to Blockstream, according to Galaxy Digital research head Alex Thorn. As of the latest reports, the funds had not yet been returned.
Also read: Harmony proposes sunsetting layer-1 blockchain and migrating ONE to Ethereum
SideSwap, a decentralized exchange operating on Liquid, reported that the withdrawal passed through its peg-out service as a customer order using its Peg-out Authorization Key (PAK). However, SideSwap clarified that the key was not compromised. Instead, it stated the L-BTC used in the transaction originated from a bug in Elements rather than a failure in SideSwap’s own systems.
Scale of the incident and network impact
The withdrawn Bitcoin represented roughly 95% of the federation wallet’s approximately 4,200 BTC balance before the incident. Liquid said other assets issued on the network, including USDT, DePix and real-world assets, remained unaffected. The sidechain stayed paused while federation members worked to address the vulnerability.
Also read: Why did an OG Bitcoin holder burn $1M? On-chain data offers clues but no answers
The incident marks one of the largest single withdrawals in the history of sidechain networks. It also raises questions about the security assumptions of federated peg mechanisms, which rely on a consortium of functionaries to safeguard funds. While white-hat actors typically aim to secure assets rather than profit from them, the scale of this event has drawn attention to the risks inherent in bridging technologies that lock Bitcoin on a main chain and issue representations on a secondary network.
Why this matters for Bitcoin users
Liquid serves as a settlement layer for traders, exchanges and institutional users seeking faster Bitcoin transactions and access to tokenized assets. The pause disrupts services that depend on L-BTC liquidity, including swaps, lending and issuance of security tokens. The incident also highlights the operational risks of sidechains, which rely on a federation of signers rather than the full proof-of-work security of the Bitcoin mainnet.
The response from the purported white hats — demanding a network-wide patch before returning funds — mirrors tactics seen in previous high-profile incidents, where ethical hackers have taken control of vulnerable assets to force remediation. Whether the funds are ultimately returned will likely depend on the speed and completeness of the patch deployment across the Liquid federation.
Conclusion
The Liquid Network remains paused as federation members work to patch the underlying Elements vulnerability. The incident has removed 95% of the wallet’s Bitcoin reserves and disrupted exchange operations, underscoring the fragility of federated sidechain security. While the actors claim they will return the funds after remediation, the timeline remains uncertain. This is a developing story, and further updates will be provided as more information becomes available.
FAQs
Q1: What is the Liquid Network?
The Liquid Network is a Bitcoin sidechain developed by Blockstream that enables faster, more confidential transactions and the issuance of tokenized assets. It uses a federated model where a group of functionaries, rather than miners, validates transactions.
Q2: Were user funds on exchanges affected?
Exchanges using Liquid paused or prepared to pause L-BTC deposits and withdrawals during the incident. However, Liquid stated that other assets issued on the network, such as USDT and real-world assets, were unaffected. Users should check with their respective exchanges for specific status updates.
Q3: What is a white-hat hacker in this context?
A white-hat hacker is a security researcher who identifies and exploits vulnerabilities to expose them to the system’s operators rather than for malicious gain. In this case, the actors claim they will return the withdrawn Bitcoin once the vulnerability is patched and all nodes are updated.
This article is for informational purposes only and does not constitute financial advice. Cryptocurrency markets are highly volatile, and readers should conduct their own research before making any investment decisions.
Be the first to comment