Liquid Network Pauses After $320 Million Bitcoin Exploit

The Liquid Network, a Bitcoin sidechain maintained by Blockstream, has suspended operations following a software bug that allowed the unauthorized withdrawal of approximately 4,000 BTC, valued at roughly $320 million [1]. The incident, which occurred on September 6, has forced the federation to disable bridge nodes and halt deposits and withdrawals of Liquid Bitcoin (L-BTC) to prevent further drainage of its reserves [1, 2].

The mechanics of the exploit

The withdrawal was executed at 14:28 UTC through the SideSwap Peg-out Authorization Key (PAK), a mechanism designed to facilitate the movement of assets between the Liquid sidechain and the Bitcoin mainnet [1, 2]. While the network operates on an 11-of-15 federation model requiring multiple signatures for such transactions, the software flaw circumvented these safeguards [2]. Blockstream and SideSwap confirmed that the issue stemmed from a bug in the Elements node software—the open-source codebase powering the infrastructure—rather than a compromise of the cryptographic keys themselves [2].

Prior to the event, the federation’s reserves held approximately 4,200 BTC [2]. Following the transaction, those reserves dropped to roughly 197 BTC, representing a 95% decline in available collateral [2]. While the network has paused, Blockstream noted that other assets hosted on the sidechain, such as USDT and tokenized securities, remain unaffected by the bug [1, 2].

Network recovery and white-hat claims

The recipient of the funds has issued on-chain messages claiming to be "white-hat" hackers—security researchers who exploit vulnerabilities to expose them rather than for personal gain [2]. Despite these claims, no funds have been returned to the federation as of the latest reports [2]. Blockstream is currently attempting to contact the parties involved via on-chain signed messages to resolve the situation [1].

For users, the impact is significant. Liquid functionality within the Aqua wallet is currently restricted, though standard Bitcoin transactions remain operational [1]. Because the network has effectively exhausted its reserves, there is a risk of a peg discount if the bridge is reopened before the funds are recovered or the balance is restored, as the network currently lacks a buffer to handle redemption demand [2].

What to watch

• Fund recovery: Monitor for any on-chain movement of the 4,000 BTC or responses from the addresses involved to the federation’s messages.
• Bridge status: Watch for updates from Blockstream regarding the restoration of bridge nodes and the reopening of L-BTC deposits and withdrawals.
• Peg stability: Observe the market price of L-BTC relative to BTC once the bridge reopens, as the depletion of reserves may create volatility in the 1:1 peg.

The incident highlights the risks inherent in federated sidechains, where the security of the bridge relies on the integrity of the underlying node software rather than just the cryptographic keys. Whether the federation can recover the assets or must find an alternative path to re-collateralize the network remains the primary uncertainty for users.