Liquid Network Reserves Drained in $320 Million Bitcoin Security Incident
Attackers fraudulently minted L-BTC to trigger a massive peg-out, compromising nearly all of the sidechain's Bitcoin reserves.
The Liquid Network, a prominent Bitcoin sidechain operated by Blockstream, suffered a massive security breach on September 6, 2026, resulting in the loss of approximately 4,000 BTC. The incident, valued at roughly $320 million, has severely compromised the network's reserve holdings and triggered an immediate suspension of its core pegging operations.
According to reports from Cointelegraph and CryptoNews AU, the attackers did not steal a private key but instead exploited the network's peg-out mechanism. The perpetrators fraudulently minted approximately 4,000 L-BTC—the sidechain's representation of Bitcoin—out of nothing and transferred them to SideSwap's peg-out desk. This action tricked the federation into paying out the equivalent amount of actual Bitcoin from its reserves to the attackers' addresses. Following the withdrawal, the attackers left an on-chain OP_RETURN message claiming, "we are whitehats. contact us on chain."
The Federation Model
Liquid Network operates as a sidechain that utilizes a federation of nodes to maintain a 1:1 peg between Bitcoin (BTC) and Liquid Bitcoin (L-BTC). In this model, the federation wallet acts as the vault, holding the BTC reserves that back every L-BTC in circulation. This architecture is designed to allow for faster transactions and more privacy than the main Bitcoin blockchain, provided the reserves remain intact to guarantee the value of the sidechain assets.
Systemic Risks to the Peg
This incident represents a critical failure of the trust model underlying the Liquid Network. Because the attackers drained the vast majority of the federation's reserves, the 1:1 backing of L-BTC is currently compromised. This creates a systemic risk for institutional users and any entity holding assets issued on the sidechain, as there is no longer sufficient Bitcoin in the vault to honor all potential peg-out requests.
Charles Guillemet, CTO of Ledger, criticized the attackers' claims of being "whitehats," noting that withdrawing hundreds of millions of dollars before making contact diverges from established ethical disclosure practices.
Recovery and Next Steps
In response to the breach, Blockstream disabled bridge nodes and requested that cryptocurrency exchanges pause all L-BTC deposits and withdrawals to prevent further losses. While block production on the Liquid Network has since resumed, peg operations remain suspended as the team works toward a recovery. The industry is now watching to see if the funds can be recovered through negotiations with the attackers or if the federation will be forced to find a way to recapitalize the reserves to restore the peg.