Liquid Network Paused After Purported ‘White-Hat’ Hackers Withdraw $320 Million in Bitcoin

Blockstream’s Liquid Network, a Bitcoin sidechain used for institutional settlement, was halted on September 6 after unknown actors claiming to be “white-hat” hackers withdrew roughly 4,000 BTC, worth about $320 million, from the federation’s reserve wallet.

The transfer drained nearly all of the federation’s pegged bitcoin. Liquid’s federation holdings fell from approximately 4,200 BTC to 207.275 BTC, according to Blockstream’s Liquid explorer.

The Liquid Network confirmed the incident in a statement posted to X at roughly 4:25 p.m. Eastern Time on September 6. “We are aware of a security incident on Liquid BTC,” the @Liquid_BTC account wrote. “Purported white-hat hackers have withdrawn 4,000 BTC ($320 million) from the Liquid Federation wallet.”

The funds were moved through the SideSwap Peg-out Authorization Key, or PAK, according to the same statement. Blockstream said that key was not compromised, nor were any others. How roughly 4,000 BTC left the federation reserve through a system designed to restrict withdrawals to approved member wallets remains unexplained.

An on-chain message from an unidentified party preceded the withdrawal: “we are whitehats. contact us on chain.” Blockstream responded on-chain with a signed message directing the actors to “Please contact [email protected].”

On-chain researcher Ergo BTC flagged two linked bitcoin transactions, according to Bitcoin.com News. The first was a large Liquid peg-out moving roughly 4,000 BTC from a pool of about 4,200 BTC. A follow-up transaction spent approximately 3,998.5 BTC and included the “whitehats” message. The bitcoin was reportedly concentrated on the Bitcoin blockchain and had not been mixed at the time of writing.

Bridge nodes on the Liquid sidechain have been temporarily disabled, meaning no new transactions can be submitted. The network is effectively paused. Liquid’s statement said other assets on the network, including USDT, DePix, and real-world asset tokens, were unaffected.

Exchanges have been notified and have paused, or will pause, LBTC deposits and withdrawals. The specific exchanges were not named.

The mechanics of the withdrawal raise questions about Liquid’s peg-out system. Liquid’s peg-out is not designed to let anyone pull bitcoin freely. Normally, LBTC is destroyed on the Liquid sidechain before federation functionaries process the corresponding bitcoin withdrawal on the mainchain. Mainchain funds require an 11-of-15 federation multisignature. The Peg-out Authorization Key system is intended to restrict payments to approved member wallets.

Possible explanations flagged by Bitcoin.com News include a compromised whitelisted wallet, abuse of Liquid’s security mechanisms, or a coordinated white-hat extraction intended to protect funds after a vulnerability was discovered. None are confirmed.

Neither Blockstream, Liquid, nor Adam Back had publicly addressed the incident as of roughly 3 p.m. Eastern Time, according to Bitcoin.com News. The Liquid_BTC account posted its statement roughly an hour and a half later.

Traders, as ever, disagree on whether the funds come back. The “white-hat” label recalls the 2021 Poly Network case, where a hacker who drained $610 million returned nearly all the funds after the project publicly appealed. Whether the Liquid actors follow that script is not known.