Bitcoin sidechain Liquid halts operations after alleged 'white hat' withdrawal of $320M in BTC
The Bitcoin-supported Liquid sidechain paused operations after actors identifying themselves as 'white hat' hackers withdrew approximately 4,000 Bitcoin worth $320 million from its federation wallet. Bridge nodes were disabled, and exchanges halted L-BTC deposits and withdrawals to prevent further transactions. Liquid’s technology provider, Blockstream, initiated contact with the actors through signed on-chain messages, seeking the return of funds once the vulnerability was patched.
Operational Pause and Federation Response
On Sunday, Liquid announced that its bridge nodes were disabled, effectively blocking new transactions on the Liquid network. Multiple cryptocurrency exchanges had halted or were preparing to halt deposits and withdrawals of L-BTC, the primary token used on Liquid. Federation members are actively working to fix the vulnerability that led to this security incident.
Communication with the Alleged ‘White Hat’ Actors
Blockstream, Liquid's technology provider, initiated contact with the actors responsible for the Bitcoin withdrawal through signed on-chain messages. The actors indicated willingness to return most of the Bitcoin after the vulnerability is patched and all nodes are updated. They also provided encrypted technical details to Blockstream to assist in resolving the flaw, as stated by Galaxy Digital’s research head, Alex Thorn.
Technical Aspects and Service Reactions
The withdrawal passed through SideSwap’s peg-out service, executed as a customer order using its Peg-out Authorization Key (PAK). SideSwap asserted that the key itself was not compromised and attributed the cause to a bug in Elements, the open-source software underlying Liquid, rather than an issue in SideSwap’s systems. The withdrawn Bitcoin accounted for roughly 95% of the federation wallet’s balance, approximately 4,200 BTC prior to the incident. Other assets on the network, including USDT, DePix, and real-world assets, remain unaffected. As of writing, the Liquid sidechain remains paused.
Why it matters
This incident exposed a critical vulnerability within Liquid’s infrastructure, a major Bitcoin sidechain. The withdrawal of nearly the entire BTC reserve from the federation wallet signals a serious security concern that could impact user trust and L-BTC liquidity. The actors, identifying as ‘white hats,’ and their willingness to cooperate with Blockstream to patch the flaw and return funds illustrate a new dynamic of engagement with the community. The unfolding developments will reveal Liquid’s resilience and the broader implications for Bitcoin’s ecosystem and derivative technologies.
Prepared from the source material with AI-assisted editing and checked against the supplied facts.
Open original source ↗