Liquid Network Federation Wallet Drained of $320 Million in Bitcoin
Blockstream pauses bridge nodes after approximately 4,000 BTC are removed from the sidechain's collateral wallet.
The Liquid Network, a Bitcoin sidechain developed by Blockstream, suffered a massive security breach around September 6-7, 2026, resulting in the loss of approximately 4,000 BTC. The theft, valued at roughly US$320 million, represents a critical blow to the network's collateral reserves.
Attackers targeted the Liquid Federation wallet, which holds the Bitcoin necessary to back the issuance of LBTC on the sidechain. The treasury held over 4,200 BTC prior to the incident; following the breach, between 3,996 and 4,019 BTC were removed. In the immediate aftermath, Blockstream paused bridge nodes and formally requested that cryptocurrency exchanges halt all LBTC deposits and withdrawals while the vulnerability is investigated. The attackers left an OP_RETURN message on the blockchain stating, "we are whitehats. contact us on chain."
The Federated Model
The Liquid Network operates as a federated sidechain, designed to provide faster and more private Bitcoin transactions than the main layer-1 blockchain. Unlike the decentralized nature of Bitcoin itself, Liquid relies on a "federation" of trusted members to manage the bridge between the two networks. When users move Bitcoin onto the sidechain, the assets are locked in a federation wallet to maintain the 1:1 peg of LBTC. This architecture allows for the issuance of digital assets and increased liquidity for institutional users, but it necessitates a high degree of trust in the federation's security protocols.
Systemic Implications
This breach exposes a fundamental vulnerability in the trust model of federated sidechains: the centralization of collateral. By concentrating backing assets in a federation wallet, the network created a single point of failure. The removal of nearly 95% of the wallet's BTC reserves directly threatens the stability and peg of LBTC. For the exchanges and institutional players that rely on Liquid for high-speed settlement and liquidity, the loss of collateral introduces significant counterparty risk and undermines the perceived security of the sidechain ecosystem.
Next Steps
Attention now turns to whether the individuals claiming to be "whitehats" will return the funds or if the assets will be moved to mixers to obscure their trail. Blockstream has not yet released a full technical post-mortem detailing how the federation wallet was compromised. Market participants are closely watching for the resumption of LBTC transfers and any potential recovery plan to replenish the collateral reserves to ensure the sidechain remains viable.