On Sunday 6 September, Liquid Network said it plainly. A security incident. Actors calling themselves white hats withdrew about 4,000 bitcoin, near $320 million, from the federation wallet. Blockstream, the technical provider, is trying to reach them on-chain, with a signed message. The sidechain is paused. Bitcoin itself did not stop.

A useful sentence first. Liquid is not Bitcoin. It is a sidechain: a chain beside the chain, hung on a peg. You deposit bitcoin. You receive L-BTC, one for one. You can send it back. The peg is a federation. Not Layer 1 miners. Not Lightning. A club of keys.

What Liquid is, in short sentences

Blockstream built it for bitcoin markets: blocks of about one minute, confidential amounts, other assets (USDT, tokenised paper). Fifteen “functionaries” sign blocks. It takes 11 of 15 to move the vault. By Q1 2026 the federation counted 87 members. The official docs are clear: you gain speed, you give up Bitcoin’s trustless model. See docs.liquid.net.

A peg-in locks BTC. After 102 confirmations you claim L-BTC. A peg-out burns L-BTC. The federation releases BTC to an authorised address, via a PAK (Peg-out Authorization Key). SideSwap, a member, runs that bridge for the public. A Liquid wallet is not a Layer 1 wallet. The keys differ. So does the risk.

What happened on Sunday

The Defiant, on the chain: two withdrawals to `bc1q…qjlte`. First 2.49749857 BTC. Then 3,995.99999857 BTC. That address’s balance: 3,998.49748445 BTC, near $79,901 a coin. The federation wallet after: on the order of 197 to 207 BTC, against about 4,200 before. The Block: nearly 95% of reserves. We file the ranges. We do not write a novel.

Four hours later, an `OP_RETURN`: “we are whitehats. contact us on chain.” A thousand sats sent back to the vault. Blockstream answered on-chain: “Please contact security@blockstream.com.” “White hat” is a claim. Not a police stamp. Liquid says “purported”. We keep the word.

mempool.space, 6 September 2026: two outputs to bc1q…6gyqjlte (3,995.99999857 and 2.49749857 BTC), OP_RETURN “we are whitehats. contact us on chain”, 1,000 sats returned, 3,998.49748445 BTC still on the address.
mempool.space, 6 September 2026: two outputs to bc1q…6gyqjlte (3,995.99999857 and 2.49749857 BTC), OP_RETURN “we are whitehats. contact us on chain”, 1,000 sats returned, 3,998.49748445 BTC still on the address.

On mempool.space, around 20:30 on 6 September, the chain reads without a press release. Two orange arrows to `bc1q…6gyqjlte`: 3,995.99999857 BTC and 2.49749857 BTC. An `OP_RETURN` in the clear: “we are whitehats. contact us on chain.” A thousand sats (0.00001000 BTC) go to an address `…xsuhwxxr`. 3,998.49748445 BTC remain on the receiving address. Fee: 1 sat/vB. This is not a rumour. It is an explorer. We do not make it a verdict. We make it a reading.

4,000 bitcoin left. The SideSwap PAK was used. The key, Liquid says, was not compromised. The chain is paused. Three sentences. Not a sermon.— Liquid Network, 6 September 2026

The key, the bug, the bridge

Liquid: the funds left via the SideSwap PAK. That key was not stolen, nor were the others. SideSwap, in a post: at 14:05 UTC a customer sent 4,000 L-BTC to the peg-out desk. The desk treated it like any other order. The L-BTC was burned, with a valid authorisation. At 14:28 the federation paid 3,996 BTC. Blockstream later found that L-BTC had been created by a bug in Elements, Liquid’s software. SideSwap could not tell it from ordinary L-BTC.

Samson Mow (JAN3) offers a working theory: confidential transactions, a node issue, not PAKs or HSMs. That is not a signed incident report. We quote it. We do not certify it. Technical notes circulate about a rangeproof cache. They stay unheld until Blockstream owns them.

Exchanges were told. L-BTC deposits and withdrawals paused. USDT, DePix, other RWAs on Liquid: unaffected, the network says. Bridge nodes are off. No new transactions. Aqua (JAN3): Liquid features hindered, on-chain bitcoin intact. As we wrote for Robinhood Chain: a design has an off button. Here the button is federal.

What it changes for a reader

If you never touched Liquid: nothing, on Layer 1. Mining goes on. ETFs do not have to “save” a sidechain. If you hold L-BTC, a swap, an Aqua or SideSwap wallet: wait for official status. Sign nothing a stranger sends “to recover”. That is a drainer move.

Liquid sold a faster, quieter, more “market” bitcoin. Sunday prices the trade: trust 11 keys out of 15, and the software that says what was burned. That is not a betrayal of Layer 1. It is the federation’s contract, read aloud.

What is held, what is not

  • Held: Liquid’s 6 September statement. ~4,000 BTC / ~$320 million left the vault. SideSwap PAK used, key not compromised (Liquid). Bridges cut, L-BTC paused at exchanges. USDT, DePix, RWAs “unaffected”. On-chain “we are whitehats”. Blockstream reply to security@blockstream.com. SideSwap: 4,000 L-BTC order, 3,996 BTC paid, Elements bug per Blockstream.
  • Held, chain: two withdrawals to `bc1q…qjlte`, balance ~3,998.5 BTC (The Defiant / CoinGecko). Remaining reserves ~200 BTC. Bitcoin L1 not halted.
  • Not held: that the actors are honest white hats. That they will return coins. A public incident report. That 11-of-15 “broke”. A USDT loss. A buy or sell.

We will reread the vault when Blockstream publishes. Until then: a paused sidechain, a Layer 1 that is not the story, and a reader who need not improvise.

Sources: Liquid Network, SideSwap, The Block, The Defiant, docs.liquid.net, Blockstream help. Nothing here is investment advice.