Liquid Network Pauses After White-Hat Hackers Withdraw $320 Million in BTC
Blockstream's Bitcoin sidechain faced a major security breach involving the unauthorized withdrawal of 4,000 BTC from the federation wallet.
The Liquid Network experienced a significant security incident on September 6, 2026, leading to a disruption of its network activity. The event centered on a massive unauthorized withdrawal from the network's core infrastructure, raising immediate concerns over the security of the Bitcoin sidechain.
According to reports from The Block and Crypto Briefing, approximately 4,000 BTC—valued at roughly $320 million—was withdrawn from the Liquid Federation wallet. The individuals responsible for the move identified themselves as "white-hat" hackers via an on-chain message, suggesting the breach was intended to expose vulnerabilities rather than for malicious theft. In a statement shared via X, the Liquid Network confirmed they were aware of the security incident.
The Role of the Liquid Network
Liquid Network is a federated sidechain of Bitcoin developed and maintained by Blockstream. Unlike the main Bitcoin blockchain, which relies on decentralized mining, Liquid utilizes a federation of members to manage its security and operations. This structure is designed to enable faster transaction speeds and the issuance of digital assets, providing a more flexible environment for institutional users and developers while remaining pegged to the value of Bitcoin.
Implications for Federated Security
This incident underscores the inherent vulnerabilities present in federated wallet structures. While federation models offer efficiency and speed, they create concentrated points of failure that can be exploited. The loss of $320 million in capital demonstrates that even established sidechains are susceptible to significant capital flight if the underlying security of the federation wallet is compromised. For users, the resulting network pause disrupts the primary utility of the sidechain, freezing assets and halting the movement of digital assets until security is restored.
Next Steps for Blockstream
Blockstream is currently attempting to establish contact with the individuals who withdrew the funds to negotiate their return. Meanwhile, federation members are working to resolve the technical breach and implement safeguards to prevent a recurrence. It remains to be seen whether the funds will be recovered and exactly how the "white-hats" gained access to the federation wallet, as the full technical details of the exploit have not yet been publicly disclosed.