Liquid Network suffers a security breach with 4,000 BTC feared lost

Liquid Network acknowledged a security breach on Sunday (September 6) after nearly 4,000 BTC, valued at approximately $320 million, were taken from the Bitcoin wallet of Liquid Federation. 

A peg-out, the federation says, it did not authorize the normal way

The party behind the transfer left an on-chain message. An OP_RETURN reading “we are whitehats. contact us on chain” appears in Bitcoin transaction “c103de…e69a19.”

In its post on X, Liquid said “purported white-hat hackers” had withdrawn the coins and that Blockstream was trying to contact them on-chain with a signed message.

ErgoBTC identified the large Bitcoin payout as transaction ” 8db751…a7b140.” It sent roughly 3,996 BTC to “bc1qgs…c6wt7p” and was confirmed in Bitcoin block 965,783 at 14:28:56 UTC on September 6.

On the side of Liquid, Blockstream’s explorer shows the associated transaction, “ce4cae…e988f2,” involving a 3,996.01834922-LBTC peg-out.

Liquid claims that the withdrawal employed SideSwap’s peg-out authorization key (PAK), even though the SideSwap PAK was not breached. This difference is crucial in getting some clarity on what happened.

What a PAK is supposed to prevent

Liquid uses a two-way peg between Bitcoin and its sidechain. Users lock BTC to mint Liquid Bitcoin, or LBTC, then burn LBTC to release the underlying Bitcoin, according to Liquid’s developer documentation.

Peg-outs are gated by a Peg-out Authorization Key. The documentation says the PAK is designed so that “even if a set of functionaries were compromised, they couldn’t redirect user funds to attacker-controlled addresses.”

In instances where the valid SideSwap PAK was used, if the key was not compromised, then the main question would be where exactly in the control path did the error happen. The present evidence does not give any indication that anything went wrong with Bitcoin itself

As shown in Liquid’s technical documentation, their concept of Strong Federation requires a minimum of two-thirds of block signers to approve blocks, whereas spending Bitcoins held by the Federation requires a greater than two-thirds watchman threshold.

“White hat” is a claim, not a verdict

It would be hasty to classify the actors as white hats only on the basis of their assertion.

It had earlier been reported that the protocol responsible for decentralized cross-chain transactions, TAC, handled a hack of around $2.8 million as a white-hat operation only after the hacker accepted a 10% cut and returned the remainder.

Until Liquid’s BTC is sent back, “white hat” can be regarded as a claim, not a fact.

Similarly, the impact on the market is much more complicated than what is being speculated based on the headline figures. Moving BTC on-chain does not mean that the selling pressure is necessarily occurring. That depends on whether the funds reach exchanges, and there is currently no cited evidence that they have.

The bigger test is confidence in federated bridges

According to TRM Labs’ report, vulnerabilities related to infrastructure and operations account for around 15% of the incidents during the first half of 2026, while they were responsible for an astounding 76% of total losses in monetary terms. This indicates that disruptions related to custody and bridges can outweigh the impact of months of smaller exploits.

In July 2026, the paper published by Heritage Falodun and Samson Ojo notes that only approximately 0.8% of circulating BTC is employed in DeFi, while up to 30% of Ethereum is engaged in that market. The authors also suggested that trust and institutional infrastructure are the major reasons why capital doesn’t flow into Bitcoin.

Additionally, Blockstream’s May roadmap emphasizes the necessity of reducing reliance on trust-based schemes across the industry. In particular, the company is working on the development of a BitVM 1-of-n bridge model. In the case that federated designs continue to cause incidents like this, the significance of this work increases substantially.

It remains to be seen what the parties involved in the withdrawal will respond to Blockstream, and whether the almost 4,000 BTC will be returned, remain parked, or moved to exchanges.

So, for now, this situation has become not just a test of security for Liquid, but a test of the level of trust that the Bitcoin users give to federated bridges.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.