Liquid Network Pauses After 4,000 BTC Withdrawal From Federation Wallet Over $320 Million

Liquid Network paused operations after a purported $320 million Bitcoin withdrawal from multisig reserve addresses on its federated Bitcoin sidechain, with the party behind the transaction claiming it was a white-hat rescue tied to a suspected security flaw.

“Bitcoin blocks kept moving as normal.”

TradingView

Liquid said the withdrawal removed roughly 4,000 BTC from the Liquid Federation wallet, and it disabled bridge nodes while engineers reviewed the incident and checked whether funds remained secure.

BigGo Finance

The incident was framed as not affecting Bitcoin mainnet, because “Bitcoin blocks kept moving as normal,” while the pause concerned Liquid’s sidechain transaction processing.

Liquid’s own update also said the funds left through the SideSwap Peg-out Authorisation Key (PAK), while stressing that “that key was not compromised, nor were any others,” leaving the mechanism of the withdrawal unresolved.

By September 6, the withdrawal was tied to a specific Bitcoin block, with one report citing that the transaction landed in block 965,783 at 14:28:56 UTC.

Survivors of the incident narrative hinge on on-chain messaging, including a later transaction that attached “we are whitehats. contact us on chain” after the withdrawal.

Blockstream responded through an on-chain message directing the actor to “[email protected],” while other reporting said the actors claimed they would return most of the Bitcoin after a vulnerability was patched and every node installed the fix.

Bitcoin Magazine

The Defiant reported that Liquid disabled bridge nodes so no new transactions could be submitted and that exchanges were told to pause L-BTC deposits and withdrawals, while USDT, DePix and other assets issued on Liquid were unaffected.T

In parallel, the Defiant described the peg wallet as an 11-of-15 multisig constrained again by the PAK list, and it noted that the route into the peg was left unexplained because Liquid said the money left through a working authorization key rather than a stolen one.T

The Defiant also quoted Ledger’s Charles Guillemet saying the conduct did not match responsible disclosure, writing that “White hats don’t drain a bridge and then solicit an ‘on-chain’ contact,” comparing it to the Ronin bridge attack.T

Liquid’s pause immediately affected users and exchanges relying on the sidechain for transfers and settlement, because Liquid said it had disabled bridge nodes and notified exchanges to suspend L-BTC deposits and withdrawals.

“Liquid said the funds were withdrawn through the Peg-out Authorization Key, or PAK”

LCX Exchange

The Defiant reported that the wallet backing L-BTC now held 197.47 BTC after two transactions, while other reporting described the withdrawal as roughly 95% of the wallet’s approximately 4,200 BTC balance.T

Liquid also said other assets issued on Liquid, including USDT and DePix, were not directly affected, but the network-level shutdown still impacted Liquid wallets while the investigation continued.

Until Liquid publishes a post-incident report and confirms recovery, multiple outlets framed the $320 million figure as approximate value moved rather than a final loss, with the key question centered on whether the actors return the funds and what flaw allowed the peg-out.

The stakes extend beyond the withdrawn BTC because the incident raised unresolved questions about the federated peg-out controls—specifically how a withdrawal could pass authorization without the relevant key being stolen—while Blockstream and federation members worked to restore normal activity.