<h3 id="key-takeaways">Key Takeaways</h3>
<ul>
 <li>Approximately 4,000 BTC valued at $320 million was extracted from Liquid Network’s federation wallet by individuals claiming to be ethical hackers</li>
 <li>The vulnerability originated from a code flaw in Elements, the open-source framework underlying Liquid, rather than from compromised cryptographic keys</li>
 <li>The extraction occurred via SideSwap, an authorized trading interface, which complicated early detection efforts</li>
 <li>The individuals responsible are engaging with Blockstream through blockchain-based Bitcoin messages and have pledged to restore the assets following vulnerability remediation</li>
 <li>Additional digital assets on the platform, including USDT, remained unaffected by the incident</li>
</ul>
<p>Liquid Network, a Bitcoin layer-2 solution utilized by cryptocurrency exchanges for accelerated transaction settlement, has suspended all network activity following the extraction of approximately $320 million in Bitcoin by actors identifying themselves as ethical security researchers.</p>
<div class="embed-x">
 <blockquote class="twitter-tweet">
  <p>We are aware of a security incident on <a href="https://x.com/Liquid_BTC?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@Liquid_BTC</a>. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The <a href="https://x.com/Blockstream?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@Blockstream</a> team is working on contacting them on-chain with a signed message.</p>
  <p>What we know so far is that the funds…</p>
  <p>— Liquid Network <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f30a.png" alt="🌊" style="height: 1em; max-height: 1em;"> (@Liquid_BTC) <a href="https://x.com/Liquid_BTC/status/2096696272447218108?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">September 6, 2026</a></p>
 </blockquote>
</div>
<p>The security breach occurred on Sunday, September 7, when individuals claiming white-hat status removed roughly 4,000 of the 4,200 Bitcoin stored within Liquid’s federated custody system. This represents approximately 95% of the network’s entire Bitcoin reserves.</p>
<h3 id="understanding-liquid-network">Understanding Liquid Network</h3>
<p>Blockstream introduced Liquid Network in 2018 as a Bitcoin sidechain solution engineered to enable cryptocurrency exchanges to execute settlements more rapidly than the primary Bitcoin blockchain permits.</p>
<div class="embed-x">
 <blockquote class="twitter-tweet">
  <p>JUST IN: 4,000 Bitcoin worth $320 million withdrawn following Liquid Network hack.</p>
  <p>The hacker is now communicating with network maintainers through on-chain Bitcoin transactions &amp; intends to return the <a href="https://x.com/search?q=%24BTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$BTC</a> after the vulnerability is fixed. <a href="https://t.co/OXpS1X3oqK" rel="noopener noreferrer nofollow">pic.twitter.com/OXpS1X3oqK</a></p>
  <p>— Watcher.Guru (@WatcherGuru) <a href="https://x.com/WatcherGuru/status/2096826035736088800?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">September 7, 2026</a></p>
 </blockquote>
</div>
<p>The platform generates L-BTC tokens, which maintain a 1:1 peg with actual Bitcoin secured in a federated wallet structure. This federation comprises over 80 participating entities, including cryptocurrency exchanges, blockchain infrastructure providers, and institutional asset management firms.</p>
<p>The extraction of nearly the complete reserve has sparked significant concerns regarding the security architecture of this settlement framework.</p>
<h3 id="technical-details-of-the-security-breach">Technical Details of the Security Breach</h3>
<p>Unlike most cryptocurrency security incidents this year, this breach did not result from credential theft or private key compromise.</p>
<p>Rather, a critical vulnerability in Elements—the open-source codebase powering Liquid—enabled the generation of Bitcoin units without proper backing. These improperly created assets were subsequently transferred through SideSwap, a legitimate and authorized trading interface operating on the network.</p>
<p>SideSwap representatives confirmed their Peg-out Authorization Key remained secure and uncompromised. The platform stated it lacked the capability to distinguish between legitimately backed coins and those generated through the vulnerability, resulting in uniform processing of all withdrawal requests.</p>
<p>Cybersecurity experts have identified the vulnerability as existing within the node-level transaction processing software of Liquid, distinct from hardware security modules or cryptographic key management infrastructure.</p>
<blockquote>
 <p>The individuals responsible have transmitted blockchain-inscribed Bitcoin messages directly to Blockstream. One communication stated: “Please fix the bug first. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”</p>
</blockquote>
<p>According to Galaxy Digital’s head of research, Alex Thorn, the hackers have also transmitted encrypted technical documentation to Blockstream to facilitate identification and remediation of the security flaw.</p>
<p>As of this publication, the extracted Bitcoin remains unreturned and the network continues to operate under suspension. Bridge node infrastructure has been deactivated, and participating exchanges have either suspended or initiated procedures to halt L-BTC deposit and withdrawal functionality.</p>
<p>Liquid representatives confirmed that alternative digital assets hosted on the network, including Tether (USDT), DePix, and tokenized real-world assets, experienced no impact from this incident.</p>
<p>This security event arrives just days after a $6 million exploit targeting a decentralized lending protocol associated with Crypto.com, and follows earlier security incidents involving Coldcard hardware wallet devices. Blockstream has not disclosed a projected timeline for network restoration.</p>
<p>The post <a href="https://blockonomi.com/liquid-network-halts-operations-following-320m-bitcoin-vulnerability-exploit/" rel="noopener noreferrer nofollow">Liquid Network Halts Operations Following $320M Bitcoin Vulnerability Exploit</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.</p>

Liquid Network Halts Operations Following $320M Bitcoin Vulnerability Exploit

Table of Contents

Blockonomi

Other articles published on Sep 7, 2026

Join our free newsletter for daily crypto updates!