Key Insights
- Bitcoin News: The Liquid Network paused after roughly 4,000 BTC left federation reserves.
- SideSwap said invalid L-BTC triggered a valid peg-out through its service.
- On-chain messages indicated that the actor planned to repay after a network patch.
Bitcoin News focused on Liquid Network after roughly 4,000 BTC left its federation wallet on Sept. 6, 2026. Liquid paused the sidechain after the withdrawal exposed a failure in its peg-out process. Blockstream and federation members began investigating the underlying software flaw.
The incident tested Liquid’s federated security model without affecting Bitcoin’s base layer. Liquid and SideSwap stated that no Peg-out Authorization Key was compromised. Instead, their statements pointed to a software validation failure involving Elements.
Bitcoin News: Liquid Halts After $320M BTC Withdrawal
Liquid Network stated that purported white-hat hackers withdrew about 4,000 BTC, worth roughly $320 million. The network disabled bridge nodes and told exchanges to pause Liquid Bitcoin deposits and withdrawals. The network said USDT, DePix, and tokenized real assets were unaffected.
The Liquid Network also said the withdrawal used SideSwap’s Peg-out Authorization Key. However, the key and other authorization keys remained uncompromised according to the network. Federation members halted new submissions while developers investigated.
Reuters reported Liquid held about 4,200 BTC before the incident, making the withdrawal roughly 95% of reserves. CoinMarketCap data showed the Bitcoin price near $79,829 on Sept. 7. BTC traded about 0.2% lower over the past 24 hours, indicating limited market reaction.
How Liquid’s Peg-Out Process Cleared the Withdrawal
SideSwap said a customer sent 4,000 L-BTC to its peg-out service at 14:05 UTC. The service burned the tokens with valid authorization under Liquid’s normal withdrawal process. At 14:28 UTC, the federation paid 3,996 BTC to the customer’s Bitcoin address.
SideSwap stated that Blockstream later traced those L-BTC units to a bug in Elements software. The company said its authorization key and internal systems were not compromised. SideSwap’s statement is also trending with the latest Bitcoin news that it could not distinguish those tokens from other L-BTC.
Official Liquid Network documentation states that Liquid Bitcoin (L-BTC) maintains a one-to-one peg with Bitcoin. Users destroy L-BTC during a peg-out before the federation releases corresponding BTC. Peg-out Authorization Key entries restrict withdrawals to destinations linked with approved participants.
The same documentation says many users access peg-outs through approved participants or exchanges. SideSwap performs that intermediary role for users without direct peg-out access. SideSwap asked users to stop new peg-ins and peg-outs during the network suspension.
Blockstream documentation states that the federation uses an 11-of-15 multisignature wallet for normal spending. That structure limits unilateral withdrawals by any single functionary. The Sept. 6 event, therefore, shifted scrutiny toward transaction validation rather than stolen federation keys.
Bitcoin News: On-Chain Messages Shift Focus to a Patch
Mempool.space data showed the main peg-out transaction confirmed in Bitcoin block 965,783. A later transaction carried the message, “we are whitehats. contact us on chain.” Blockstream subsequently responded on-chain, asking the sender to contact its security team.
Bitcoin Remembers later indexed another message asking to return most of the funds to the federation address. A separate message at block 965,875 said repayment would follow a full network patch. It also asked Blockstream to patch every node before receiving the funds.
Mempool.space records showed the holding address still controlled roughly 3,998 BTC early on Sept. 7. Those records showed no confirmed large return at that point. The transfer, therefore, remained unresolved despite the on-chain communication.
Those messages strengthened the actor’s stated white-hat narrative but did not confirm its identity. Liquid continued using the term “purported white-hat hackers.” No public technical report or Bitcoin news had confirmed the full exploit path by Sept. 7.
Blockstream Faces Network Restart and Disclosure Test
Liquid’s documentation describes the sidechain as a federated settlement network for Bitcoin and issued assets. The federation controls the main-chain BTC backing L-BTC while functionaries operate the network consensus. That model depends on software validation working before authorized withdrawals reach Bitcoin.
The incident exposed a separate risk from private-key theft. A valid-looking peg-out reached the federation even though SideSwap reported no key compromise. The apparent Elements flaw, therefore, became the central technical issue facing Blockstream and Liquid developers.
According to recent Bitcoin News, Liquid said that federation members were working to restore normal network activity. However, the project gave no public restart time in its initial statement. SideSwap also kept swaps, peg-ins, and peg-outs suspended while Liquid remained offline.
The next verifiable milestone is the deployment of an Elements patch across Liquid nodes. A network restart would then test whether federation members consider the flaw contained. Any confirmed return of the withdrawn BTC would provide the next test of the white-hat claim.
