Key Insights
- Bitcoin News: The Liquid Network paused after roughly 4,000 BTC left federation reserves.
- SideSwap said invalid L-BTC triggered a valid peg-out through its service.
- On-chain messages indicated that the actor planned to repay after a network patch.
Bitcoin coverage focused on the Liquid Network after approximately 4,000 BTC exited its federation wallet on September 6, 2026. This sudden withdrawal exposed a vulnerability in the peg-out mechanism, prompting Liquid to temporarily halt the sidechain. Blockstream and fellow federation members immediately initiated investigations into the underlying software flaw.
While testing Liquid’s federated security framework, the event left Bitcoin’s base layer entirely unaffected. Both Liquid and SideSwap confirmed that no Peg-out Authorization Key was compromised, instead attributing the incident to a software validation issue tied to Elements.
Bitcoin News: Liquid Halts After $320M BTC Withdrawal
According to the Liquid Network, individuals acting as purported white-hat hackers withdrew roughly 4,000 BTC, valued at approximately $320 million. In response, the network deactivated bridge nodes and instructed exchanges to suspend all Liquid Bitcoin deposits and withdrawals. Officials noted that USDT, DePix, and tokenized real-world assets remained secure and unaffected.
The network acknowledged that the withdrawal utilized SideSwap’s Peg-out Authorization Key. However, both entities reiterated that this key and all other authorization keys remained fully secure. Federation members temporarily halted new transaction submissions while developers reviewed the code.
Reuters reported that Liquid held about 4,200 BTC prior to the event, meaning the withdrawal accounted for roughly 95% of its total reserves. Meanwhile, CoinMarketCap data placed the price of Bitcoin near $79,829 on September 7, with BTC down just 0.2% over a 24-hour window, showing a muted broader market reaction.
How Liquid’s Peg-Out Process Cleared the Withdrawal
SideSwap reported that a customer submitted 4,000 L-BTC to its peg-out service at 14:05 UTC. Under normal operating procedures, the service burned the tokens with valid authorization, and at 14:28 UTC, the federation disbursed 3,996 BTC to the user’s designated Bitcoin address.
Subsequent tracing by Blockstream linked those specific L-BTC units to a bug within the Elements software, according to SideSwap. The company emphasized that its internal infrastructure and authorization keys were never compromised. SideSwap’s statement emerged alongside broader discussions regarding how its platform could not differentiate those specific tokens from standard L-BTC.
Official documentation shows that Liquid Bitcoin (L-BTC) maintains a strict one-to-one peg with Bitcoin. During a peg-out, users destroy L-BTC before the federation releases the equivalent BTC, with Peg-out Authorization Key entries ensuring funds route only to approved participant destinations.
The same guidelines note that many users access these peg-outs via approved exchanges or intermediaries like SideSwap. During the current network suspension, SideSwap has requested that users halt all new peg-ins and peg-outs.
Blockstream documentation highlights that the federation relies on an 11-of-15 multisignature wallet for standard spending, which prevents single functionaries from executing unilateral withdrawals. Consequently, the September 6 incident turned attention toward transaction validation flaws rather than stolen keys.
Bitcoin News: On-Chain Messages Shift Focus to a Patch
Data from Mempool.space confirmed that the primary peg-out transaction settled in Bitcoin block 965,783. A subsequent transaction included the on-chain message, “we are whitehats. contact us on chain,” prompting Blockstream to reply publicly and direct the sender to its security team.
Bitcoin Remembers later indexed another message proposing to send most of the assets back to the federation address. A separate dispatch at block 965,875 specified that repayment would happen only after a complete network patch was deployed and all nodes were updated by Blockstream.
Mempool.space records confirmed that early on September 7, the holding address still maintained roughly 3,998 BTC with no major return transactions processed yet, leaving the transfer technically unresolved despite ongoing blockchain communication.
While these communications lent credibility to the actor’s white-hat assertions, their true identity remained unverified. Liquid continued referencing the participants as “purported white-hat hackers,” with no exhaustive technical autopsy officially published by September 7.
Blockstream Faces Network Restart and Disclosure Test
Liquid functions as a federated settlement layer for Bitcoin and associated assets, where the federation manages main-chain BTC reserves while functionaries oversee consensus. This framework fundamentally relies on flawless software validation prior to releasing authorized funds onto the Bitcoin blockchain.
Because SideSwap verified that no private keys were stolen, the event highlighted a distinct structural risk: a seemingly valid peg-out circumvented normal checks due to an apparent Elements software flaw, placing the spotlight squarely on Blockstream and Liquid developers.
Recent reports indicate federation members are actively working to restore standard network operations, though initial updates omitted a definitive restart timeline. SideSwap’s swaps, peg-ins, and peg-outs remain offline indefinitely.
The rollout of an Elements patch across all Liquid nodes represents the next critical milestone. Successfully restarting the network will test whether the vulnerability is fully mitigated, while any eventual return of the funds will serve as the next benchmark for the actor’s white-hat claims.
FAQ
- What caused the Liquid Network pause? Roughly 4,000 BTC left federation reserves due to a software validation failure involving Elements.
- Were any private keys stolen? No. Both Liquid and SideSwap confirmed that their authorization keys remained uncompromised.
- Have the funds been returned? On-chain messages indicated the funds would be repaid after a full network patch, but transfers were unresolved as of September 7.
- Are other assets like USDT affected? No, Liquid stated that USDT, DePix, and tokenized real assets remained safe and unaffected.
