The Liquid Network, a Bitcoin sidechain federation, reportedly halted new transactions after unknown actors withdrew roughly 4,000 BTC from its federation wallet, an amount valued at approximately $320 million.
The Liquid Network, a Bitcoin sidechain federation, reportedly halted new transactions after unknown actors withdrew roughly 4,000 BTC from its federation wallet, an amount valued at approximately $320 million. The Liquid hack, so far documented through secondary reporting rather than a directly fetched official statement, has not been independently reconciled, and key details about attacker motive, the exact sums involved and any recovery remain unconfirmed.
What to Know
- Reporting attributes the withdrawal of about 4,000 BTC from the Liquid Network to unknown actors who described themselves as white hats.
- Developers reportedly halted new transactions and disabled bridge nodes, though which specific activities stopped and for how long is not fully established.
Liquid Hack: Reported Theft of 4,000 BTC
On September 6, 2026, unknown actors withdrew about 4,000 BTC, worth roughly $320 million, from the Liquid Network federation wallet, according to reporting attributed to the project team. Liquid is a Bitcoin sidechain: users lock BTC on the base chain and receive Liquid Bitcoin, or L-BTC, a one-to-one representation issued and redeemed by a federation of functionaries. For related coverage, see Bitcoin Splits Into Two Chains as BIP-110 Enforcement Chain Halts.
Liquid Network: reported approximate withdrawal
About 4,000 BTC
The withdrawal quantity is approximate and has not been reconciled against an independent ledger. Reporting attributes to the trading interface SideSwap a peg-out order of 4,000 L-BTC received at 14:05 UTC, followed by a federation payout of 3,996 BTC at 14:28 UTC. These are reported order and payout figures, not a single confirmed on-chain transfer total. For related coverage, see AgriNext Awards & Conference Dubai 2026: Where Agriculture Leaders, Innovators and Investors Shape the Future of Food Systems.
A dollar valuation for the event should be treated with care. Bitcoin traded at roughly $79,478 during this research window, down about 0.36% over 24 hours, but that snapshot is broad market context and does not represent an incident-time valuation or a hack-driven price response. This account of the reported theft closely parallels a separate summary that the Liquid Network said purported white hats withdrew 4,000 BTC.
SideSwap denied any unauthorized access to its systems or theft of its peg-out authorization key, and attributed the creation of unbacked L-BTC to an Elements software bug identified by Blockstream specialists, according to the reporting. The characterization of the actors as benevolent white-hat hackers is their reported self-description, according to unconfirmed reports, not a verified identity or motive. For related coverage, see Capital B Bitcoin Holdings Reach 3,521 After 376 BTC Buy.
What the Reported Liquid Halt Means for Users
Developers disabled bridge nodes and halted new transactions, and notified exchanges to suspend L-BTC deposits and withdrawals, according to the incident reporting. This establishes the reported scope of the pause on the sidechain; it does not establish any halt on the Bitcoin base chain, which continued producing blocks normally.
The distinction matters. A reported halt is not a verified, itemized suspension of every service, and the supplied evidence does not identify affected users or establish losses to customer balances. The Liquid team reportedly said USDT, DePix and other Liquid assets were unaffected, but that claim, according to unconfirmed reports, was not independently checked at the asset level.
No restart time, compensation plan or confirmed restriction on access to user funds is established by the available evidence. Galaxy head of research Alex Thorn highlighted on-chain communications in which the actors offered to return most funds after a fix, though the described exchange did not specify an exact amount. A conditional promise to return most funds, according to unconfirmed reports, does not establish recovery or an enforceable sum.
The episode echoes other recent sidechain and bridge incidents, including when Maya Protocol halted after an exploit tied to stolen Bitcoin. Broad market sentiment showed no clear stress: the Fear & Greed Index read 71, classified as Greed, on September 7, though that gauge measures the whole market rather than Liquid-specific reaction.
What Remains Unconfirmed About the Liquid Incident
The primary verification priorities are straightforward: the incident date, the reported amount of about 4,000 BTC and the precise scope of the halt. Each currently rests on secondary reporting labeled as AI translated, with the original Liquid and SideSwap statements linked but not directly confirmed in this research.
The available context does not establish attacker identity, the exact attack method or recovery status. Researcher OrangeSurf raised questions about patch deployment and large peg-out controls, and proposed a cryptographic verification-cache explanation; that is a researcher assessment, according to unconfirmed reports, not an independently verified postmortem, and the referenced repository commit was not directly examined.
Liquid’s custody architecture offers background but not attribution. In an August 15, 2023 announcement, the network said its functionary source code had become publicly available for auditing, describing Blocksigner software as coordinating block signatures and Watchmen software as managing pegged bitcoin, peg-outs and UTXO sweeps. That 2023 description, including an 11-of-15 wallet configuration, is historical and does not identify which component, if any, was compromised in this event.
Bitcoin’s base layer remained unaffected throughout the reported sidechain disruption, continuing to produce blocks roughly every ten minutes under its difficulty adjustment. The Liquid federation is a layer built atop that settlement assurance, and any final accounting of user loss, funds returned or exploited code will require the original incident postmortem and reconciled on-chain records that have not yet been verified.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
