Liquid Network Pauses After White-Hat Hackers Withdraw 4,000 BTC From Federation Reserves

Blockstream has paused Liquid, its federated Bitcoin sidechain, after what it described as purported white-hat hackers withdrew 4,000 BTC — roughly $320 million — from the Liquid Federation wallet. The network lets a federation of exchanges and institutions custody bitcoin and issue the pegged LBTC token. The company said it is working to contact the actors on-chain with a signed message, according to a security notice posted on Blockstream’s status page.

Withdrawal Used the SideSwap Peg-out Key

Blockstream said the bitcoin was moved through the SideSwap PAK, a peg-out authorization key that lets funds leave the network, but stressed that the key itself was not compromised, nor were any others. A peg-out is the mechanism that releases bitcoin from the sidechain back to the main Bitcoin chain. The disclosure keeps the event framed as a security incident rather than a confirmed exploit, and the company has not said whether any of the withdrawn bitcoin has been recovered. Blockstream also shared a mempool.space address so the public can track the funds in real time while the investigation continues.

Bridge Nodes Disabled and LBTC Paused

Exchanges have been notified and have already paused, or will pause, LBTC deposits and withdrawals, Blockstream said. Other Liquid assets such as USDT, DePix, and real-world assets are unaffected by the incident. Bridge nodes have been temporarily disabled so no new transactions can be submitted, effectively halting the sidechain until the issue is resolved and normal network activity can be restored. While the pause is in effect, LBTC holders cannot move the pegged token on or off the sidechain through exchanges.