Blockstream’s Liquid Network has lost roughly 4,000 BTC, about $320M, after attackers drained the federation wallet that backs the Bitcoin sidechain. Liquid said Sunday that the withdrawal removed close to 95 percent of the wallet’s holdings, which stood near 4,200 BTC before the incident.
The company disabled its bridge nodes while federation members investigate and asked exchanges to suspend L-BTC deposits and withdrawals. The Bitcoin moved out through SideSwap using a Peg-out Authorization Key, yet Liquid said neither SideSwap’s key nor any other PAK appeared compromised, leaving investigators to explain how an apparently authorized peg-out emptied the wallet.
The people behind the drain say they are not ordinary thieves. A message embedded in a Bitcoin transaction identified them as “whitehats” and asked Blockstream to make contact. The two sides later moved to encrypted channels, and the hackers said they would return most of the funds once the vulnerability is fixed and every node is patched. “The chain is under risk at latest commit right now,” the on-chain message warned.
Other assets issued on Liquid, including stablecoins, do not appear to have been directly affected, and the Bitcoin network itself was untouched. The episode is a fresh reminder that a federated sidechain does not inherit Bitcoin’s security model: member functionaries, not miners, collectively manage the funds backing L-BTC, and one flawed authorization path can move almost everything.
