Liquid Network Pauses After Reported $320M Bitcoin Withdrawal

Liquid Network says it has paused its bitcoin sidechain after purported white-hat hackers withdrew an estimated $320 million in bitcoin from the Liquid Federation wallet, disabling bridge nodes and halting new transaction submissions while it investigates. The figures are preliminary protocol estimates, and the actors’ intent, authorization, and any recovery remain unverified.

What the reported Liquid Network pause involves

The Liquid Network pause was disclosed in an official incident statement from the protocol, which said purported white-hat hackers withdrew approximately 4,000 BTC from the Liquid Federation wallet, a multisignature peg custody set managed by the network’s functionaries. For related coverage, see Strategy Halts Bitcoin Purchases After Major Acquisitions.

Withdrawal estimate reported by Liquid

~4,000 BTC

What the headline reports

Liquid valued the outflow at approximately $320 million, describing it as a reported withdrawal rather than a confirmed permanent loss. That $320 million is the protocol’s own estimate, not a transfer-time valuation tied to a verified transaction hash or historical bitcoin price. For related coverage, see Solana, XRP, Ethereum ETFs in Red as Bitcoin ETF Adds $100M.

The network said bridge nodes had been temporarily disabled, which prevents new transaction submissions and effectively pauses the Liquid sidechain until the issue is resolved. For Liquid users, that means peg-ins, peg-outs, and on-chain movement of Liquid-native assets are stalled while the federation halts block progression. For related coverage, see Bitcoin Slides as Jobs Report Revives Fed Hike Odds.

According to the statement, the withdrawal used the SideSwap Peg-out Authorization Key (PAK), while the protocol asserted that this key and other keys were not compromised. The underlying mechanism, how a withdrawal executed through a PAK without a key compromise, is not established by the available evidence and should not be presented as a confirmed exploit path.

Details the supplied context does not establish

No independent block-explorer entry, transaction hash, sender or receiver address, or confirmed transfer timestamp was available to corroborate the movement. A separate report circulated an exact figure of 3,998 BTC, but the official statement says only approximately 4,000 BTC, and the precise figure has not been verified. This mirrors early coverage that the Liquid sidechain was paused after a federation-wallet outflow, though the exact quantity remains contested.

Liquid said exchanges had been notified and had paused, or would pause, LBTC deposits and withdrawals, though no individual exchange confirmation was available. The protocol also stated that USDT, DePix, and real-world assets issued on Liquid were unaffected, while warning that Liquid wallets would be impacted, an attributed asset-impact assessment rather than proof of uninterrupted settlement.

Why the ‘white-hat’ characterization needs verification

Claimed intent and authorization

The statement describes the actors as purported white-hat hackers, a qualifier that signals the network has not confirmed their identity, intent, or authorization. No disclosure agreement, bug-bounty scope, or actor self-description was available to substantiate a benevolent classification.

Liquid said Blockstream was working to contact the purported hackers on-chain using a signed message, referencing an officially linked monitoring address. The available evidence did not establish a response from the actors or any return of funds.

Withdrawal does not establish recovery or final loss

A withdrawal from the federation wallet is not, on its own, evidence of either a permanent loss or a successful rescue. Whether the bitcoin is recoverable, whether custody sits with cooperative actors, and whether funds will be returned are unresolved questions, not settled facts.

The Liquid Federation’s security model separates duties between functionaries. The protocol’s own August 2023 architecture documentation describes Watchmen managing the multisignature wallet, peg-outs, and UTXO sweeping, with Blocksigner coordinating Liquid block signatures. How those roles interacted with a PAK-authorized withdrawal is exactly the mechanism that no independent postmortem has yet explained.

What remains unknown about the pause and funds

Scope of the pause and service status

The precise set of affected functions, the degree of user exposure, and any restart timeline are not established by the available material. The statement confirms bridge nodes were disabled and the sidechain paused, but does not specify resumption conditions or a governance path back to normal operation.

Fund custody and recovery status

Current custody of the bitcoin, and whether any portion has moved since the initial disclosure, is unverified. Confirming the incident requires an attributable, timestamped incident summary, a verifiable on-chain transaction linking the federation wallet to a destination, and an operational update from the network before further claims can be added.

Broader market conditions offer no signal on the incident: bitcoin traded at $79,847 with a flat 24-hour move at the time of retrieval, and no event-window analysis attributes any price action to the pause. This is a snapshot only, not a demonstrated reaction, and readers weighing bitcoin’s near-term price outlook should treat the two as unrelated absent further evidence.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.