Liquid Network Pauses After $320M Bitcoin Peg-Out Drains Most Reserves

Liquid Network has paused its Bitcoin sidechain after nearly 4,000 BTC worth about $320 million left the federation wallet through a SideSwap peg-out, reducing the reserve from roughly 4,200 BTC to about 200 BTC.

The security incident unfolded on September 6 and removed roughly 95% of the Bitcoin backing L-BTC. Bridge nodes were subsequently disabled, preventing new transactions from entering Liquid, while exchanges were instructed to suspend L-BTC deposits and withdrawals.

SideSwap Peg-Out Released 3,996 BTC

The withdrawal passed through SideSwap’s Peg-out Authorization Key, or PAK, which is authorized to request Bitcoin redemptions from Liquid’s federation.

A customer sent roughly 4,000 L-BTC through SideSwap’s peg-out service shortly after 14:05 UTC. The federation then released approximately 3,996 BTC on Bitcoin at 14:28 UTC.

The SideSwap authorization key was not compromised, nor has Liquid identified a compromise of the federation’s other signing keys. The L-BTC presented for redemption instead originated from an apparent bug in Elements, the open-source software underlying Liquid.

That distinction makes the incident materially different from a stolen bridge key or multisig takeover. The peg-out followed an authorized path, but the L-BTC entering that process should not have existed with corresponding Bitcoin backing.

A technical analysis of the exact Elements vulnerability has not yet been published.

Bitcoin Moves to Address Claiming ‘Whitehats’

The withdrawn funds were consolidated into a Bitcoin address holding roughly 3,998 BTC. An onchain transaction included the message: “we are whitehats. contact us on chain.”

Blockstream responded through Bitcoin with contact information for its security team as efforts began to establish communication with the address controllers.

The white-hat characterization remains unverified. Ledger CTO Charles Guillemet questioned the approach, arguing that draining nearly an entire bridge reserve before seeking contact falls outside conventional responsible-disclosure practices. The Bitcoin remained concentrated in the identified address early September 7 rather than moving through exchanges, mixers or cross-chain services.

Recent attackers have taken very different paths after obtaining Bitcoin. Funds from the Coldcard Wave 3 attack began moving through THORChain last week, converting BTC into ETH as investigators tracked the new destination addresses.

Liquid Remains Paused While Elements Bug Is Investigated

Liquid represents BTC locked on Bitcoin as L-BTC on its sidechain, with federation members operating the infrastructure securing peg-ins and peg-outs. USDT, DePix and other assets issued on Liquid were not directly affected by the unauthorized L-BTC creation, although the network pause prevents normal transaction processing.

The episode also differs from conventional bridge drains such as the $24.15 million AFX Trade exploit, where validator signatures authorized an unauthorized USDC withdrawal from bridge reserves.

Liquid bridge nodes remained disabled early September 7, exchanges were keeping L-BTC deposits and withdrawals suspended, and roughly 3,998 BTC remained at the Bitcoin address connected to the withdrawal.

The post Liquid Network Pauses After $320M Bitcoin Peg-Out Drains Most Reserves appeared first on Crypto Adventure.