Bitcoin sidechain Liquid halts operations after $320M BTC withdrawal by purported white hats

The Bitcoin sidechain Liquid paused operations on September 7, 2026, after a group purporting to be white-hat hackers drained about 4,000 BTC (valued at $320 million) from its federation wallet. According to a statement from the Liquid network, bridge nodes were disabled to prevent new transactions, and exchanges either paused or prepared to suspend deposits and withdrawals of L-BTC, the sidechain's native token.

Blockstream, the technology provider behind Liquid, initiated contact with the actors via signed onchain messages. In subsequent communications, the hackers indicated they would return the majority of the 4,000 Bitcoin once a vulnerability in the Elements software—the open-source platform underpinning the sidechain—is patched across the network. The incident highlights ongoing security risks in layer-2 solutions built atop Bitcoin.

Why This Matters

Users holding L-BTC on exchanges may face delayed access to funds until the situation is resolved.
The incident raises questions about the security model of federated sidechains and the risk of a single exploit affecting multiple custodians.
A successful white-hat operation could set a precedent for how vulnerabilities in Bitcoin layer-2 protocols are handled, but if the actors are not legitimate, the loss of $320 million would be a major blow to confidence.

Background

Liquid is a federated sidechain built on top of Bitcoin, designed to enable faster, more confidential transactions and the issuance of digital assets. It is operated by a federation of over 60 functionaries and relies on the Elements open-source software. The network has been operational since 2018 and is used by exchanges and institutions for settlement. Sunday's withdrawal is one of the largest security incidents involving a Bitcoin sidechain.

Key Perspectives

Blockstream and Liquid Federation: Their immediate priority is patching the vulnerability and recovering the funds. They are cooperating with the purported white hats and have disabled bridge nodes to contain the incident. Purported White-Hat Hackers: They claim the withdrawal was a security test to expose a flaw in Elements. Their offer to return most of the BTC after a patch suggests they seek to improve network security without causing permanent loss. Critics and Skeptics: Some may question whether the actors are truly white hats, given the magnitude of the withdrawal and the lack of prior coordination. Others worry that even a temporary loss of $320 million could shake confidence in federated sidechains and encourage more aggressive exploitation attempts.

What to Watch

Blockstream's timeline for releasing a patch for the Elements vulnerability and how quickly federation members deploy it.
Whether the purported white hats follow through on returning the 4,000 BTC after the patch, and whether any funds are lost in the process.
How exchanges handle L-BTC trading and withdrawals during the pause, and whether the incident triggers broader liquidity concerns.

ZOTPAPER