Key Takeaways
- • Blockstream's Liquid Network halted operations after purported white-hat hackers withdrew approximately 4,200 BTC (~$320 million) from the Liquid Federation wallet on September 6, 2026, representing a significant drain on the sidechain's collateral reserves.
- • The withdrawal was executed via the SideSwap PAK (Peg-out Authorization Key), though Blockstream confirmed that neither this key nor other critical keys were compromised, limiting the scope of the security vulnerability to a specific authorization mechanism.
- • Liquid's federation members disabled bridge nodes and paused LBTC deposits and withdrawals across exchanges to contain the incident, though other Liquid assets including USDT, DePix, and tokenized real-world assets remain unaffected.
- • The sidechain's balance plummeted to approximately 207 BTC following the withdrawal, materially reducing Liquid's capacity to support peg-in and peg-out operations and creating operational constraints for dependent platforms including the Aqua Bitcoin wallet.
- • Blockstream initiated direct contact with the purported white-hat actors through on-chain signed messages while federation members worked to restore network operations, suggesting potential recovery negotiations or verification of the attackers' stated intentions.
Summary
Liquid Network, a Bitcoin sidechain developed and operated by Blockstream, suspended operations on September 6, 2026, following the unauthorized withdrawal of approximately 4,200 BTC valued at $320 million from the Liquid Federation wallet. The incident marks a material security event for one of Bitcoin's primary sidechains, which facilitates faster transaction settlement and supports tokenized assets on a separate ledger pegged to the Bitcoin mainchain.
According to Blockstream's official statement, purported white-hat hackers executed the withdrawal through the SideSwap PAK, a specific authorization key used for peg-out transactions. The company emphasized that the SideSwap PAK itself and other critical federation keys remained uncompromised, indicating the attack exploited a discrete vulnerability rather than a systemic key management failure. The transaction included an on-chain message claiming white-hat involvement and inviting Blockstream to establish contact, a characteristic common to security researchers conducting responsible vulnerability disclosures.
In response, Blockstream halted Liquid Bitcoin (LBTC) deposits and withdrawals across all connected exchanges and disabled bridge nodes, effectively pausing the sidechain and preventing new transaction submissions. This containment measure reduced Liquid's federation wallet balance to approximately 207 BTC, substantially diminishing the collateral available to support future peg-in and peg-out operations. The incident created downstream impacts for wallet providers dependent on Liquid functionality, including Aqua Bitcoin, which reported transaction processing constraints as its Liquid integration experienced operational disruptions. However, the freeze was selective: other Liquid-native assets including USDT, DePix, and tokenized real-world assets remained unaffected, limiting contagion to the Bitcoin-specific infrastructure.
Blockstream and federation members initiated direct communication with the purported white-hat actors through signed on-chain messages while working to restore network operations. This approach suggests either ongoing negotiation for fund recovery or verification of the attackers' stated intentions before proceeding with full remediation. The security incident highlights risks inherent to sidechain architectures, where federation custody mechanisms and authorization keys represent concentrated points of failure despite cryptographic safeguards.
According to Blockstream's official statement, purported white-hat hackers executed the withdrawal through the SideSwap PAK, a specific authorization key used for peg-out transactions. The company emphasized that the SideSwap PAK itself and other critical federation keys remained uncompromised, indicating the attack exploited a discrete vulnerability rather than a systemic key management failure. The transaction included an on-chain message claiming white-hat involvement and inviting Blockstream to establish contact, a characteristic common to security researchers conducting responsible vulnerability disclosures.
In response, Blockstream halted Liquid Bitcoin (LBTC) deposits and withdrawals across all connected exchanges and disabled bridge nodes, effectively pausing the sidechain and preventing new transaction submissions. This containment measure reduced Liquid's federation wallet balance to approximately 207 BTC, substantially diminishing the collateral available to support future peg-in and peg-out operations. The incident created downstream impacts for wallet providers dependent on Liquid functionality, including Aqua Bitcoin, which reported transaction processing constraints as its Liquid integration experienced operational disruptions. However, the freeze was selective: other Liquid-native assets including USDT, DePix, and tokenized real-world assets remained unaffected, limiting contagion to the Bitcoin-specific infrastructure.
Blockstream and federation members initiated direct communication with the purported white-hat actors through signed on-chain messages while working to restore network operations. This approach suggests either ongoing negotiation for fund recovery or verification of the attackers' stated intentions before proceeding with full remediation. The security incident highlights risks inherent to sidechain architectures, where federation custody mechanisms and authorization keys represent concentrated points of failure despite cryptographic safeguards.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.