A withdrawal of roughly 4,000 BTC — about $320 million — from the Liquid Network's federation wallet has forced the Bitcoin sidechain to disable its bridge nodes and suspend new transactions, according to statements the Liquid team posted on X.

The network, operated by Blockstream, said the funds were taken by "purported white-hat hackers" who later signaled they would return the Bitcoin once the underlying vulnerability is patched. As of publication, the assets had not been confirmed as returned.

How did 4,000 BTC leave the wallet?

Before the incident, Liquid's federation wallet held approximately 4,200 BTC. The withdrawal removed close to 95% of that balance, making it one of the largest crypto security incidents of the year by dollar value.

Liquid said the transaction executed through SideSwap, a platform authorized to handle Liquid peg-outs. The SideSwap Peg-out Authorization Key and other federation keys were not compromised, distinguishing the exploit from conventional private-key breaches.

The vulnerability is reported to reside in Liquid's software stack rather than in stolen signing material. The attackers used what appears to be a legitimate peg-out path, raising questions about whether the federation's transaction-validation logic failed to flag or block the operation.

What did the attackers claim?

An on-chain message associated with the withdrawn funds urged Liquid to patch every affected node before attempting to recover the Bitcoin. Liquid wrote on X: "The @Blockstream team is working on contacting them on-chain with a signed message."

The white-hat identification remains unverified. Liquid has consistently used the qualifier "purported" when describing the actors, and the funds have not yet been confirmed back in federation custody.

How does this compare to other 2026 exploits?

The roughly $320 million lost exceeds the combined total of reported crypto hacks during August, which Altcoin Buzz tallied at $136 million across 50 cases. By scale alone, the Liquid episode reshapes the year's threat tally and targets a Bitcoin settlement rail rather than a typical DeFi protocol or token contract.

Liquid was built to deliver faster and more confidential Bitcoin settlement for exchanges and institutional counterparties. Bitcoin deposited into the network is represented as L-BTC and settles on the sidechain rather than the base layer. The near-total depletion of BTC reserves therefore strains the integrity of that settlement process.

What is the operational fallout?

Beyond the bridge-node shutdown, several exchanges have suspended or signaled plans to suspend L-BTC deposits and withdrawals. Other assets issued on Liquid — including USDT, DePix and real-world asset tokens — were reported unaffected by the security incident.

Liquid's federation, its governing multisig, must reach consensus on a patched software build before resuming operations. Until then, L-BTC holders face redemption uncertainty and any counterparty using Liquid for exchange settlement confronts a temporary but material operational gap.

What comes next?

Three issues will determine the outcome. First, whether developers can identify and contain the vulnerability without further loss. Second, whether the federation can safely restart the network under revised controls. Third, and most consequential, whether the roughly 4,000 BTC actually return to the wallet.

Until the actors sign a verifiable on-chain confirmation and the federation authorizes a coordinated recovery transaction, the funds remain outside the network's custody and the network stays paused.