Liquid pauses after $320M bitcoin withdrawal

Liquid Network has paused operations after roughly 4,000 bitcoin, worth about $320 million, were withdrawn from its federation wallet by actors claiming to be white-hat hackers. The episode has forced the Bitcoin sidechain into a defensive posture while Blockstream and other participants assess the breach and the status of the funds.

The network said bridge nodes were disabled on Sunday, which prevented new transactions from moving through the system. Exchanges had also stopped, or were preparing to stop, L-BTC deposits and withdrawals as the situation developed. The freeze effectively cut off the usual flow between bitcoin on the main chain and the Liquid-side asset used on the network.

Blockstream, which provides Liquid’s technology, began reaching out to the actors with signed onchain messages. Those messages showed the group telling Blockstream to patch a vulnerability in Elements and make sure every node was updated before the funds would be returned. The actors also sent encrypted technical details, according to Galaxy Digital research head Alex Thorn.

The funds had not been returned at the time of publication. That leaves the sidechain in a temporary standstill, with the main question now whether the withdrawal was an attempted exploit, a test of the network’s controls, or a coordinated disclosure meant to force a rapid software fix.

How the withdrawal appeared to happen

SideSwap said the transfer moved through its peg-out service as a customer order using a Peg-out Authorization Key, or PAK. The company added that the key itself was not compromised, shifting attention toward how the transaction was authorized and whether the vulnerability lay elsewhere in the system. The exact technical path has not been publicly resolved.

Liquid is a federated sidechain, so its safety depends on bridge nodes and coordinated validation across the network. When those nodes were disabled, normal movement of assets stalled quickly. For traders and exchanges that support L-BTC, that means deposits and withdrawals can be suspended even if the main Bitcoin network continues to function normally.

Why the incident matters for market participants

The event matters because Liquid is used for faster, more private bitcoin transfers and for moving value between venues. Any breakdown in its bridge mechanics can disrupt exchange operations, settlement flows and liquidity management for users who rely on the sidechain. It also raises fresh scrutiny over the security of federated systems that sit alongside Bitcoin.

For now, the immediate priority is patching the Elements vulnerability and confirming that all nodes are running the same updated software. Until that happens, the network remains paused and the returned status of the 4,000 BTC is unresolved. The episode is likely to keep attention on operational risk in Bitcoin-linked infrastructure, especially where bridge controls and authorization keys are involved.

This article is not investment advice and recommends no asset, level or direction; a single session's move is not evidence of a trend. For background see Crypto, Altcoin, Bitcoin, and for terms the finance glossary.