The Liquid Network federation wallet balance plunged from 4,200 BTC to just 207.275 BTC on September 7, 2026. This massive drop occurred shortly after 3,993 BTC worth approximately $319 million was forcefully drained from the Blockstream-developed Bitcoin sidechain network.
The party behind the withdrawal left an OP_RETURN message within an unconfirmed transaction stating, “we are whitehats. contact us on chain.” On-chain analyst DBCrypto observed that the coins, worth hundreds of millions of dollars, remain idle on the Bitcoin mainnet and have not been obfuscated through coin mixing services. This passive movement pattern is far more consistent with a white hat rescue aimed at securing funds rather than an outright theft by malicious hackers.
Blockstream responded to the withdrawal by halting bridge node operations, requiring all cryptocurrency exchanges to suspend LBTC deposits and withdrawals until the issue is resolved.
Software Bug, Not Leaked Keys
The massive $319 million sum flowed out through the SideSwap platform. SideSwap management addressed the matter by confirming that their Peg-out Authorization Key (PAK) remains secure and was not compromised in any way.
Blockstream clarified the situation, stating that the exploit occurred due to a bug in the Elements software. The vulnerability exploited by the actor purely involved a flaw in the underlying software code and was unrelated to leaked keys.
Who Signed the Transaction?
The disappearance of coins from the federation wallet has raised fresh questions regarding the security of Liquid Network’s 11-of-15 multisig model. DBCrypto outlined two possibilities for how the funds escaped: either 11 of the 15 federation functionaries signed off on the massive withdrawal, or Liquid’s whitelist system failed to block unauthorized transactions. DBCrypto noted that neither scenario reflects well on Liquid’s security posture in the eyes of users.
Samson Mow, CEO of Jan3, stated that all operators are actively working to resolve the network flaw. He described the incident as a tough time, though expressed confidence that they will get through it.
Blockstream and its prominent figurehead Adam Back have yet to post any comments on X at the time of writing. For LBTC holders, the suspended bridge node means their assets remain completely isolated from the Bitcoin mainnet, leaving them waiting to see if the self-proclaimed white hat follows through. Source: Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
