Liquid Network Halts Operations After $320 Million Bitcoin Withdrawal Due to Software Bug

This incident raises critical questions about the security and reliability of federated sidechains in the cryptocurrency ecosystem.

• On September 6, 2026, the Liquid Network paused operations after a significant withdrawal of approximately 4,000 BTC, valued at $320 million.
• A software bug in the Elements software allowed the creation of invalid L-BTC tokens, enabling the unauthorized peg-out transaction.
• Blockstream responded by halting bridge nodes and advising exchanges to suspend L-BTC activities while attempting to contact the unidentified actors.

• Liquid Network operates as a federated Bitcoin sidechain, utilizing an 11-of-15 multisig model for reserve management and Peg-out Authorization Keys (PAKs) for secure withdrawals.
• Prior to the incident, the federation held around 4,200 BTC backing L-BTC tokens, with no preceding events indicating a security risk.
• The consensus bug allowed for the inflation of L-BTC, which was exploited without detection by the SideSwap service provider.

On September 6, 2026, between 14:01 and 14:28 UTC, two transactions facilitated the withdrawal of nearly 4,000 BTC from the Liquid federation wallet to a new Bitcoin address. This peg-out was authorized by the SideSwap Peg-out Authorization Key (PAK), which, due to a bug in the Elements software, processed the creation of non-existent L-BTC tokens. The bug allowed invalid tokens to be treated as legitimate, leading to the unauthorized withdrawal.

The perpetrators, claiming to be "whitehats," embedded an OP_RETURN message in the transaction, indicating their intent to communicate with Blockstream. This prompted Blockstream to initiate contact while simultaneously pausing all bridge nodes and advising exchanges to halt L-BTC deposits and withdrawals. The incident drained approximately 95% of the network's Bitcoin reserves, leaving only around 207 BTC remaining.

Blockstream confirmed that no PAKs were compromised, indicating that the security of the authorization keys themselves was intact. However, the incident has raised significant concerns regarding the security models of federated sidechains, particularly in how they manage consensus and validate transactions. The lack of detection of the bug prior to the incident suggests potential weaknesses in the oversight and testing processes for such critical software.

Market reactions were relatively muted, with Bitcoin's price showing only a slight increase of about 0.10%. However, the implications for Liquid Network users are significant, as they face a temporary inability to process L-BTC deposits and withdrawals. The incident has sparked discussions among market participants about the robustness of federated sidechain security models and the need for enhanced protocols to prevent similar occurrences in the future.

As the Liquid Federation members work towards restoring normal operations, the incident serves as a reminder of the inherent risks associated with innovative financial technologies and the importance of maintaining rigorous security standards.

• Liquid Network users: Immediate inability to process L-BTC transactions, affecting liquidity and trading strategies.
• Exchanges: Temporary suspension of L-BTC activities, impacting trading volumes and user confidence.
• Developers and security teams: Increased scrutiny on security protocols and software testing processes within federated systems.

• Ongoing communication: Monitor Blockstream's outreach to the unidentified actors for potential recovery of funds and insights into the exploit.
• Security audits: Watch for announcements regarding enhanced security measures or audits of the Elements software to prevent future vulnerabilities.
• Market sentiment: Observe how this incident affects user trust in federated sidechains and the broader cryptocurrency market dynamics.