Liquid Network pauses after $320 million Bitcoin withdrawn by purported white-hat hackers

Sep 6, 2026

Liquid Network paused its Bitcoin sidechain and disabled bridge nodes on September 6, 2026, after purported white-hat hackers withdrew approximately 4,000 BTC ($320 million) from its federation wallet. The exploit drained 95% of the network's reserves using the SideSwap Peg-out Authorization Key, though Blockstream claims the key was not compromised. The attackers left an on-chain message claiming white-hat status, prompting Blockstream to initiate negotiations while exchanges halted LBTC redemptions.

Liquid Network Bitcoin withdrawal

▪The September 6, 2026 withdrawal from the Liquid Network federation wallet represented approximately 95% of the network's total Bitcoin reserves, which stood at about 4,200 BTC before the incident
▪Purported white-hat hackers withdrew approximately 4,000 Bitcoin, valued at roughly $320 million, from the Liquid Network federation wallet on September 6, 2026

Peg-out authorization key mechanism

▪Liquid Network's peg-out mechanism is designed to require three days to update the Peg-out Authorization Key list, allowing the network to detect compromised functionaries before withdrawals can occur
▪The unauthorized withdrawal on September 6, 2026 was executed using the SideSwap Peg-out Authorization Key (PAK), though Blockstream stated that the key itself was not compromised

White-hat hacker blockchain communication

▪Blockstream responded to the Liquid Network hackers on-chain by sending a transaction with a message requesting them to contact security@blockstream.com
▪The party behind the September 6, 2026 Liquid Network withdrawal left an on-chain message in an OP_RETURN field stating, 'we are whitehats. contact us on chain.'
▪A subsequent on-chain transaction paid 69,093 satoshis requesting contact on Signal @m671aw.70, though JAN3 CEO Samson Mow stated this request did not originate from the address holding the stolen funds

Network pause bridge suspension

▪Liquid Network stated that other assets issued on its sidechain, including USDT, DePix, and tokenized real-world assets, were unaffected by the September 6, 2026 security incident
▪JAN3 CEO Samson Mow confirmed that Liquid Network wallet functionalities in the Aqua Bitcoin wallet were impacted by the network pause, though standard Bitcoin transactions remained operational
▪Liquid Network disabled its bridge nodes and temporarily paused sidechain activity on September 6, 2026 in response to the unauthorized $320 million Bitcoin withdrawal

Exchange deposit withdrawal halt

▪Because the underlying Bitcoin reserves were depleted, users holding Liquid Bitcoin (LBTC) are temporarily unable to redeem their tokens for mainnet Bitcoin
▪Liquid Network notified cryptocurrency exchanges to suspend deposits and withdrawals for Liquid Bitcoin (LBTC) following the September 6, 2026 security incident

Federation wallet reserve depletion

▪The Liquid Network federation wallet operates as an 11-of-15 multi-signature wallet, requiring signatures from 11 of its 15 corporate members to authorize Bitcoin transactions
▪Following two transactions on September 6, 2026, the Liquid Network federation wallet's reserves were depleted from over 4,200 BTC to approximately 197.47 BTC

Debatable claims

▪Draining a protocol's reserves is an unacceptable practice for white-hat hackers
▪Cryptocurrency networks should not possess centralized pause mechanisms
▪Bitcoin sidechains should abandon federated multi-signature custody models