Liquid Network: Around 4,000 Bitcoin Drained via a Peg-Out, and What L-BTC Holders Must Check Now

On the Liquid Network, the best-known Bitcoin sidechain, around 4,000 Bitcoin drained out of the shared reserve on September 6, 2026. The network has been halted since then, L-BTC currently cannot be swapped back into real Bitcoin, and several trading venues have stopped deposits and withdrawals of the token. If you hold L-BTC or use a wallet that supports Liquid, your most important task today is taking stock rather than trading.

The incident is unusual because no key was stolen. The payout was cryptographically valid. That is precisely what makes the case interesting for anyone who holds Bitcoin through a second layer.

What happened on the Liquid Network on September 6

According to several specialist outlets, between 3,998.5 and 4,019.4 Bitcoin were withdrawn from what is known as the federation wallet of the Liquid Network. At the time of the outflow the value stood at roughly $319 million to $320 million. The range arises because individual newsrooms draw the boundaries of the movement differently: tftc.io counts 3,998.5 BTC based on the on-chain data, while Bitcoin Magazine cites 4,019.4 BTC. The Liquid team itself officially speaks of around 4,000 Bitcoin.

Cryptopolitan dates the decisive transaction to Bitcoin block 965,783, confirmed on September 6, 2026 at 14:28:56 UTC. According to the analysis by tftc.io, 207.275 BTC remained in the federation wallet afterwards. Before that there were around 4,200 BTC. So roughly five percent of the reserve was left standing.

Shortly afterwards the network pulled the emergency brake. The bridge nodes were shut down, and new deposits and withdrawals between Bitcoin and Liquid are blocked. The sidechain itself continues to produce blocks, but the route back into the Bitcoin network is closed. No date for a restart has been given so far.

Peg-out, federation and PAK: how the Liquid Bitcoin bridge normally works

To understand why this case is different from an ordinary exchange hack, you need three terms.

A sidechain is an independent blockchain that is docked onto a main chain and represents its coins in wrapped form. L-BTC is the Bitcoin proxy on Liquid: a token that is meant to be backed one to one by real Bitcoin held jointly by a group of companies. That group is called the federation, and it is the actual custodian.

The way in is called a peg-in, the way out a peg-out: you lock real Bitcoin, are credited with the same amount of L-BTC, and can reverse the process later. In a peg-out the L-BTC on the sidechain are destroyed and the federation releases the real Bitcoin in return. So that no single party can do this alone, Liquid requires, as tftc.io describes it, a multisignature from eleven of the fifteen federation members plus authorisation via an allow list, the Peg-out Authorization Key, or PAK for short. A PAK is therefore the registered key that determines which Bitcoin address may be paid out to at all.

On September 6 the payout ran through the PAK of the SideSwap service. The network stresses that this key was not compromised, and that no key otherwise fell into the wrong hands. The signatures were genuine, the authorisation formally correct, and the federation did what it was built to do. The gap sat one layer earlier.

The flaw was in the software, not in the keyring

Several reports trace the process back to a bug in Elements, the open-source software Liquid is built on. The accounts differ in detail, and that difference is worth knowing rather than skimming past.

Bitcoin Magazine describes an inflation bug: more than 4,000 L-BTC are said to have been created without real Bitcoin behind them, and these were then paid out via the SideSwap PAK. A second reading, quoted in several reports, describes the sequence as an apparently regular process in which L-BTC were properly burned and just under 4,000 real Bitcoin were released as a result. Both variants lead to the same outcome: the sidechain's accounting and the federation's actual Bitcoin holdings no longer matched.

A conclusive technical post-mortem by the operators was not available at the time of writing. As long as it is missing, any statement about the exact place in the code is conjecture, and we treat it as such here.

"We are whitehats": what this on-chain message actually proves

In a follow-up transaction the other side left the message "we are whitehats. contact us on chain". In IT security a white hat is someone who finds a vulnerability and discloses it instead of exploiting it. Here the label is a self-description, no more than that.

What can be established: according to consistent reports, the Bitcoin are sitting untouched at the receiving address. Blockstream and the Liquid team are trying to make contact through signed on-chain messages. One of the reports states that the other side has held out the prospect of returning most of the sum once the Elements vulnerability is closed network-wide. That undertaking is not confirmed, and no repayment has been made to date.

For you as a holder, the choice of words changes nothing. Whether someone calls themselves a white hat does not decide whether your money comes back. Only the actual return decides that.

L-BTC is frozen: what holders should check right now

The unpleasant news first: anyone holding L-BTC can do little at the moment. The peg-out is blocked, so a swap into real Bitcoin is not possible for the time being. There is no button that solves the problem for you.

An orderly stocktake still makes sense. Open your wallets and look at whether there is any Liquid balance among them at all. The wallets mainly affected are those that support Liquid, such as SideSwap, Blockstream Green or Aqua, along with balances at trading venues that list L-BTC. If you are unsure whether a holding sits on Liquid or on the Bitcoin base layer, a look at the address format and the block explorer used will help. Note down the position with date and time so that you have a solid starting figure later, should any settlement arrangement come about.

Refrain from attempting new peg-ins now. As long as the bridge nodes are switched off, the best case is that you are sending Bitcoin into a queue whose resolution nobody can schedule. And treat offers that promise you a quick payout of your L-BTC for a fee with caution. Situations like this tend to attract fraud attempts posing as support.

USDt, DePix and RWAs on Liquid: why these assets are affected differently

Liquid carries more than wrapped Bitcoin. The official network account has stated that other issued assets are unaffected, among them the stablecoin USDt, the Brazilian DePix and tokenised real-world assets.

That is technically plausible: these tokens do not hang on the federation's Bitcoin reserve, and their backing sits with the respective issuers. The outflow from the federation wallet therefore does not touch them. In practice a problem remains, because as long as the network is halted you can move these assets only to a limited extent as well. Being unaffected and being freely available are two different things at the moment.

Exchanges halt L-BTC deposits and withdrawals: where to check the status

Several trading venues have suspended deposits and withdrawals of L-BTC or announced that they will. What counts here is solely the status page of your own provider together with its announcements, and not the summary in a news feed. That is where you will find whether only transfers are affected or trading too, and whether withdrawals in real Bitcoin remain possible by another route.

In a situation like this, pay particular attention to which networks a provider supports for deposits and withdrawals at all, and how quickly and openly it communicates about disruptions. Anyone with balances spread across several venues should go through this check today for every one of them, and not only for the one they use daily.

Sidechain, bridge, wrapped token: the counterparty risk behind every wrapped Bitcoin

The sentence that sticks from this case comes from the analysis by tftc.io: L-BTC holders had no direct claim on the underlying Bitcoin, and their risk was against a consortium of companies rather than against the Bitcoin protocol.

This is not a peculiarity of Liquid. It applies to every wrapped Bitcoin on every foreign chain. A wrapped token is a placeholder that represents on one blockchain the quantity of a coin held somewhere else. Its value hangs on two conditions: the backing has to exist, and redemption has to work. If either falls away, you hold a claim whose enforceability you may well not know.

Sidechains and bridges buy you something with real advantages in return: faster and cheaper transfers, confidential amounts, applications that do not run on the Bitcoin base layer. Anyone using them should make that trade deliberately rather than in passing. A useful rule of thumb: what sits on a second layer is working capital. What is meant to stay put for the long run belongs on the base layer in your own custody, as we described after the Coldcard incident in our assessment of the hardware wallet choice.

What the case means for your own custody

The key difference between this incident and a classic theft is the point of attack. Storing good keys well was of no help here, because the keys were fine. What broke is the rule that decides when those keys are allowed to sign.

From that follows an uncomfortable insight: the security of your holdings does not end at your own wallet. What matters is the whole chain of systems standing between you and the base layer. For a Bitcoin in your hardware wallet that chain is short. For an L-BTC in a software wallet, backed by a federation, secured through an allow list, paid out via a service with its own registered key, it is long.

In practice that means three things. Keep the amount on second layers small enough that a total loss does not knock you off course. For every wrapped token, check who the custodian is and whether one is even named. And document your holdings regularly, so that in an incident you have figures rather than memories.

What remains open

Three points were unresolved at the time of writing. There is no date for the network to restart. There is no commitment from the operators on how L-BTC balances will be handled if the Bitcoin do not come back. And there is no independent confirmation that the other side will actually repay. Anyone telling you today that the case is settled knows more than can be evidenced.

Liquid peg-out and checking your L-BTC: what to take away

1. Establish and document your holdings. Open every wallet and every account today and record whether and how much L-BTC or other Liquid balance is sitting there, with date and time. Our crypto exchange comparison helps when you reconcile the networks and withdrawal routes of your trading venues.
2. Send nothing new into the blocked bridge. Avoid peg-ins as long as the bridge nodes are switched off, and read the status exclusively at your provider and at the network operator. Which wallet supports Liquid at all, and how transparently it discloses that, is shown in our software wallet comparison.
3. Bring long-term holdings onto the base layer. Separate working capital from reserves and self-custody the part that is meant to stay put. Which devices come into question and how to tell them apart is in our hardware wallet comparison.

(As of September 7, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)