An attacker minted 3,998 L-BTC through an exploit of the Liquid Network, according to an analysis published by blockchain security firm SlowMist — the largest hack of a Bitcoin sidechain recorded so far in 2026.

SlowMist's findings establish the core mechanics of the incident: the attacker did not steal pegged bitcoin directly from user wallets but instead generated 3,998 L-BTC, the Liquid Network's native one-to-one pegged representation of bitcoin. The security firm's write-up positions the event as the most significant Bitcoin sidechain compromise of the year by minted value.

What is the Liquid Network?

The Liquid Network is a Bitcoin sidechain operated by Blockstream, the blockchain infrastructure company founded by Adam Back. It uses a federated consensus model in which a group of functionaries manages the two-way peg between BTC on the Bitcoin mainchain and L-BTC on the sidechain.

L-BTC circulates on the sidechain for faster settlement and confidential transactions, and the peg mechanism is designed so that every L-BTC in circulation is backed by an equivalent amount of BTC locked on the mainchain. Any unauthorized minting of L-BTC breaks that backing ratio, which is why mint-based exploits carry systemic weight for sidechain architecture regardless of the immediate dollar value involved.

Why does unauthorized minting matter?

An exploit that mints L-BTC rather than draining a hot wallet strikes at the integrity of the peg itself. Each unbacked L-BTC introduced into circulation dilutes the collateral guarantee that underpins the sidechain's core value proposition to exchanges, market makers and trading desks that use Liquid for settlement.

The operational consequences extend beyond the immediate loss:

• Peg integrity: the one-to-one BTC backing claim requires reconciliation against the minted supply.
• Federation response: Blockstream and the Liquid Federation control functionary keys and peg invariants, and remediation typically involves halting or constraining peg-out processing.
• Downstream exposure: any venue listing or accepting L-BTC must assess whether received funds trace to the unauthorized mint.

SlowMist's role in documenting the attack continues a pattern in which independent security firms publish post-incident technical analyses that shape exchange risk controls and on-chain tracing efforts.

What happens next?

The immediate questions now concern containment: whether the federation has frozen or restricted movement of the minted L-BTC, whether peg-out requests face enhanced screening, and how Blockstream will account publicly for the unbacked supply. Tracing firms and exchanges will likely blacklist attacker-linked addresses in the coming days as SlowMist's indicators of compromise circulate through the industry.

The incident lands at a moment of renewed scrutiny for federated sidechain designs, where trust in a functionary set replaces Bitcoin's proof-of-work consensus. How quickly the Liquid Federation restores verifiable one-to-one backing will determine whether this exploit remains a contained operational incident or becomes a lasting structural concern for institutions routing volume through the sidechain.