The Liquid Network, a Bitcoin-based sidechain operated by Blockstream, has suffered a major security incident after approximately 4,000 Bitcoin worth about $320 million was withdrawn from its federation wallet, prompting the network to temporarily halt transactions.
Liquid Network disclosed the incident in a post on X, saying the funds were withdrawn by individuals it described as “purported white-hat hackers.”
The withdrawal represented about 95 per cent of the roughly 4,200 BTC held in the federation wallet before the incident, raising fresh concerns over the security of crypto infrastructure as digital assets increasingly move towards mainstream financial and institutional use.
According to Liquid, the funds were withdrawn through the SideSwap Peg-out Authorization Key (PAK), which facilitates the movement of Bitcoin from the Liquid sidechain back to the Bitcoin network.
However, the network said the key itself was not compromised and that none of the other relevant keys had been compromised.
Following the incident, Blockstream began efforts to contact the parties responsible through an on-chain signed message, while exchanges were notified and moved to suspend, or prepare to suspend, deposits and withdrawals of Liquid’s Bitcoin-backed asset, LBTC.
Liquid also temporarily disabled its bridge nodes, preventing new transactions from being submitted to the network.
“Effectively, the Liquid sidechain is paused until this issue is resolved,” the network said.
Other assets operating on Liquid, including USDT, DePix and real-world assets, were not affected by the incident, according to the network.
Most funds returned
The security incident took a new turn after about 3,400 BTC of the withdrawn funds were returned to the Liquid Federation wallet, leaving approximately 598 BTC outstanding.
Samson Mow, a Bitcoin advocate and former chief strategy officer at Blockstream, disclosed the development in an update on X, saying the return followed confirmation from Blockstream that the affected bridge nodes had been patched.
“3,400 BTC of the roughly 4,000 BTC withdrawn on September 6 has been returned to the @Liquid_BTC Federation wallet. The return followed confirmation from @Blockstream that the affected bridge nodes have been patched. Approximately 598 BTC remains outstanding, and Blockstream continues to engage with the white-hat hackers,” Mow said.
He added that the Liquid network remained paused while Blockstream and Federation members carried out additional fixes and security improvements, resolved a chain split and prepared for a safe restart.
According to Mow, Liquid wallets and services would continue to be affected during the process, while users were advised not to send Bitcoin to Liquid peg-in addresses until the network confirms that it has restarted.
“No user action is needed, and please do not send Bitcoin to Liquid peg-in addresses until we confirm the network has restarted,” he said.
Mow said the priority was to restore normal network operations safely, adding that further updates would be provided as work on the network continued.
Crypto hacks remain a growing concern
The Liquid incident comes against the backdrop of a broader increase in the frequency of attacks targeting cryptocurrency infrastructure.
Data from blockchain intelligence firm TRM Labs showed that attackers carried out 207 separate crypto hacks in the first half of 2026, the highest number recorded by the firm in any six-month period.
Despite the increase in incidents, total losses fell to about $972 million, less than half the $2.3 billion stolen during the first half of 2025.
TRM Labs said the median loss from a crypto hack was about $219,000, while much of the increase in incidents came from smart contract exploits targeting decentralised finance protocols, decentralised exchanges and token projects.
However, infrastructure and operational compromises, which represented about 15 per cent of incidents, accounted for approximately 76 per cent of the total value stolen, highlighting the disproportionate financial impact of attacks on critical crypto infrastructure.
TRM Labs also attributed about $643 million, or roughly 66 per cent of funds stolen during the first half of 2026, to North Korea-linked activity.
The Liquid incident highlights the security challenges facing the infrastructure underpinning digital assets, particularly as cryptocurrency networks and services seek wider adoption among exchanges, financial institutions and institutional investors.
