Liquid Network Goes Dark After $320 Million Bitcoin Sidechain Exploit — Then Gets Most of It Back
September 6: The Withdrawal
Roughly 4,000 bitcoin, worth about $320 million at the time, left the federation wallet of Liquid Network on a Sunday, draining the Bitcoin sidechain’s reserves from more than 4,200 BTC down to around 197 BTC in a single stroke. Liquid is a settlement layer built by Blockstream and used by a number of exchanges and trading desks to move bitcoin between platforms faster and with more privacy than the base Bitcoin chain allows, wrapping BTC into a token called L-BTC that is meant to stay fully backed one-to-one.
Blockstream froze bridge nodes almost immediately, stopping any further transactions from settling on the network, and exchanges that rely on Liquid moved to suspend L-BTC deposits and withdrawals while the company worked out what had happened. Within hours, the team said the incident did not involve stolen federation keys. Instead, the funds had moved out through SideSwap, an approved trading platform built on top of Liquid, exploiting what Blockstream would later describe as a software bug in Elements, the Bitcoin Core fork that Liquid’s nodes run.
September 7: A Public Standoff
Whoever was behind the withdrawal did not disappear with the funds. Using OP_RETURN messages — a way of embedding short notes directly into Bitcoin transactions — the party behind the exploit identified themselves as a “white hat” and told Blockstream they intended to return most of the bitcoin, but only once the underlying vulnerability was actually fixed. The message specified that every Liquid node needed to be patched first, turning the recovery into a public, on-chain negotiation played out in full view of anyone watching the mempool.
Not everyone accepted the white-hat framing at face value. Ledger’s chief technology officer, Charles Guillemet, pushed back publicly on the idea that withholding tens of millions of dollars until a fix shipped was meaningfully different from a ransom demand, regardless of how the party described its own intentions.
September 8: Blockstream Confirms the Patch
Blockstream said it had deployed updated software to close the Elements bug and sent a PGP-signed on-chain message confirming that Liquid’s bridge nodes were patched and that it was safe to return the funds. The following Monday, roughly 3,400 BTC — about $269.2 million, or close to 85% of what had been taken — moved back into the Liquid Federation wallet.
The remaining balance, close to 598 BTC and worth in the neighborhood of $47 million, stayed with the attacker, who appears to be treating it as a self-appointed bounty for surfacing the flaw. Blockstream said it continues to engage with the party in an effort to recover the rest.
What’s Still Missing
As of this reporting, Liquid Network remains paused while the Federation prepares for a coordinated restart on the patched software, and there is no public timeline yet for when normal deposit and withdrawal activity will resume on exchanges. Other assets issued on top of Liquid — including tokenized USDT, the Brazilian stablecoin DePix, and various real-world asset tokens — were not affected by the exploit and continue to exist as before, though they remain frozen in place until the network comes back online.
The episode is a reminder that sidechains and bridges carry their own software risk separate from Bitcoin’s base layer, and that even federated systems run by well-known infrastructure teams can have bugs serious enough to briefly put nine figures of user funds in someone else’s hands. Readers who want a plainer-language walkthrough of how bitcoin actually moves between chains, wallets, and exchanges can start with coin680’s Bitcoin Academy section.
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency markets and blockchain infrastructure carry inherent security and volatility risks; always do your own research before making decisions involving digital assets.