- 4,000 BTC was withdrawn from Liquid’s Federation wallet via the SideSwap PAK, while Liquid said the authorisation key itself was not compromised.
- Liquid disabled bridge nodes and paused the sidechain, while exchanges were notified to halt LBTC deposits and withdrawals as the investigation continues.
Liquid Network confirmed a security incident after purported white-hat hackers withdrew about 4,000 Bitcoin, worth around $320 million, from the Liquid Federation wallet. The withdrawal was executed via the SideSwap PAK (Peg-out Authorisation Key), though Liquid confirmed the key itself was not compromised, nor were any others.
The federation wallet held more than 4,200 BTC before the withdrawal. Bridge nodes were immediately disabled, and the Liquid sidechain was paused, effectively freezing the network until the issue is resolved. Exchanges were notified and moved to pause LBTC deposits and withdrawals.
Moreover, other assets on the network, including USDT, DePix, and RWAs, remain unaffected.
The Negotiation Nobody Expected
After consolidating the funds, the attacker left an on-chain message that changed the entire tone of the incident. It stated that they are white hats and to contact them on-chain.
What followed was an unusual public back-and-forth between Blockstream and the hacker, conducted entirely through OP_RETURN messages and PGP-encrypted notes. This was visible to anyone watching the chain.
At 11:30 AM PDT, the hacker made initial contact. Blockstream responded at 12:31 PM. By 6:49 PM, Blockstream sent a PGP-signed encrypted message. At 7:20 PM, the hacker responded, asking whether it was acceptable to return most of the funds to a specified address.
Then, at 8:27 PM, came the critical message. The hacker asked Blockstream to fix the vulnerability first, warning that the chain remained at risk under the latest commit and that every node needed to be patched before the funds would be safely returned. PGP-encrypted technical details were shared directly with Blockstream.
Blockstream confirmed receipt at 8:30 PM. As of 9:12 PM PDT, approximately 3,998.5 BTC remained unmoved with no further messages from either side. Additionally, the PGP signature matched the key published on Blockstream’s official website, adding credibility to the white-hat claim.
What This Means for the Market?
A $320 million withdrawal from a Bitcoin sidechain, even one that appears to be moving toward resolution. The immediate market impact is uncertainty around Liquid Network’s security architecture and the broader confidence in Bitcoin sidechain infrastructure.
The hacker’s willingness to communicate, share technical vulnerability details, and commit to returning funds is an unusual and relatively positive signal. But until the patch is confirmed, every node is updated, and the funds are returned, the situation remains open.
Crypto Market Highlights
PUMP Is Compressing Hard: At a Level That Could Go Either Way
