Four thousand bitcoin left a reserve wallet. The people behind it say they are “white hats”. That is not a reassuring label when the network backing the tokens has had to stop.
Liquid Network, the Bitcoin settlement sidechain associated with Blockstream, paused new transactions after a security incident that removed roughly 4,000 BTC — about $320 million — from its federation wallet. The episode is not just another exploit headline: it is an uncomfortable stress test for a system built around a small, identifiable federation and a promise that L-BTC is backed by bitcoin.
A reserve went from 4,200 BTC to roughly 200
Liquid said on 6 September that purported white-hat hackers had withdrawn approximately 4,000 BTC from its federation wallet. Reuters reported that the wallet held about 4,200 BTC before the incident. Bitcoin Magazine, citing Blockstream’s proof-of-reserves page, reported that a little over 207 BTC remained afterwards.
The reported on-chain withdrawal was 4,019.4 BTC. That represents about 95.7% of a 4,200 BTC reserve — an almost total depletion, not a marginal operational error.
Liquid is a federated Bitcoin sidechain: it issues L-BTC, intended to be backed by BTC held on Bitcoin’s main chain. Its model is deliberately unlike an open mining network. Bitcoin Magazine describes a federation of 15 known corporate members, with 11 signatures needed to move treasury coins. That structure is supposed to make the custody arrangement legible. It also makes this event exceptionally awkward: a reserve system designed around controlled access has been forced to explain why a transaction that moved most of its backing could proceed.
“White hat” is a claim, not a settlement
Liquid’s wording is careful. It called the actors “purported white-hat hackers”, said the withdrawal went through the SideSwap Peg-out Authorisation Key (PAK), and said that key — and no other key — had been compromised. It is an important distinction: the project has not said the funds are safe, returned or under an agreed recovery process.
The claim of ethical intent arrived with an on-chain message: “we are whitehats. contact us on chain.” But a message is not a remediation plan. For L-BTC holders, exchanges and wallet operators, the immediate fact is more prosaic: bridge nodes were disabled; deposits and withdrawals were paused; and Liquid said wallets would be impacted.
That is the contradiction at the centre of this story. A conventional white-hat disclosure demonstrates a flaw while minimising harm and gives the operator a route to repair it. Here, the alleged demonstration first moved the asset base that makes the bridged token meaningful. Even if the bitcoin is returned, the method has exposed an operational reality no branding can soften: a redeemability promise can be suspended at precisely the moment holders most need it.
A valid-looking transaction is the real nightmare
Bitcoin Magazine reported that the apparent route involved an L-BTC inflation bug: newly created L-BTC was allegedly used to execute a peg-out for main-chain BTC. It reported that the federation’s hardware security modules signed the withdrawal because the transaction appeared valid under the affected consensus conditions. Liquid has not publicly confirmed that technical reconstruction, so it should be read as reporting rather than final forensic fact.
If that account proves accurate, this is bigger than a stolen credential. Key custody is the familiar threat model for a federated bridge. A flaw that makes an invalid economic claim look valid to the machinery authorising a withdrawal is nastier: the controls can work exactly as configured and still approve the wrong result.
The public response also illustrates the limits of certainty in a private sidechain. Main-chain bitcoin lets observers follow the BTC, but Liquid’s user-level exposure is not fully visible in the same way. Bitcoin Magazine noted that public information does not show how much L-BTC is held by retail users versus federation-linked corporates. That opacity makes the paused bridge more than a technical inconvenience: participants cannot easily judge who is carrying the risk while recovery discussions unfold.
The federation now has to earn its model back
Liquid said it had notified exchanges, that other issued assets including USDT, DePix and RWAs were unaffected, and that federation members were working to restore normal activity. Those are useful operational facts, but they do not close the central question: what conditions must be met before L-BTC can again be treated as fully redeemable?
There are several tests ahead. The federation needs a technically credible account of the path used, a clear explanation of what its signers and controls observed, and a recovery process that does not depend on accepting an attacker’s self-description. It also needs to tell users what happens if the claimed white hats do not cooperate. “We are working on it” is not the same as a reserve reconciliation.
For years, Bitcoin’s sidechain debate has often been framed as a trade-off between speed, confidentiality and trust assumptions. Liquid’s incident gives that debate a brutal, quantifiable number: about $320 million. The lesson is not that every federated system fails; it is that the trust boundary matters most when the peg is under pressure, not when blocks are flowing normally.
Until the bitcoin is verifiably restored or a transparent alternative is set out, “white hat” remains a claim made after a $320 million test of confidence.
Sources:
Liquid Network incident statement (6 September 2026)
Reuters: Bitcoin-based Liquid Network says $320 million withdrawn in hack (7 September 2026)
Bitcoin Magazine: alleged white-hat hackers withdraw 4,000 bitcoin (6 September 2026)
Reported peg-out transaction on mempool.space
