Liquid Network Paused After $320 Million Bitcoin Withdrawal: What Happened

Liquid Network Paused After $320 Million Bitcoin Withdrawal

Liquid Network has halted activity after roughly 4,000 bitcoin worth about $320 million was withdrawn from the reserves backing L-BTC, while the people controlling the funds claim they intend to return most of them.

What happened to Liquid Network?

Liquid Network paused activity after roughly 4,000 bitcoin, worth about $320 million at the time, was withdrawn from the federation wallet that backs its Bitcoin-linked asset, L-BTC.

The incident was disclosed on September 6. Liquid said the funds were moved by people it described as “purported white-hat hackers,” while Reuters reported that roughly 4,000 of the approximately 4,200 BTC held in the federation wallet had been withdrawn.

Liquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals while the incident was investigated. The $320 million figure is best understood as the approximate value of the Bitcoin moved at the time, not necessarily a final loss. The people controlling the funds later said they intended to return most of the Bitcoin after the underlying problem was fixed.

What is Liquid Network?

Liquid is a Bitcoin sidechain designed to support faster and more confidential transfers, particularly for exchanges, traders and financial institutions. Bitcoin placed into the system can be represented as L-BTC, which is intended to remain backed by Bitcoin held through the Liquid Federation.

Blockstream explains that the federation includes Bitcoin-focused businesses and specialised functionaries involved in operating the network and managing the Bitcoin peg. Importantly, the Bitcoin network itself was not hacked. The incident concerned Liquid’s separate infrastructure and the systems used to move Bitcoin between Liquid and the main Bitcoin network.

How were the funds withdrawn?

Liquid said the withdrawal went through SideSwap’s Peg-out Authorization Key, or PAK, while maintaining that the key itself had not been compromised. SideSwap subsequently said a customer sent 4,000 L-BTC to its peg-out service, after which the transaction was processed through an authorised route and roughly 3,996 BTC was released.

According to The Block, SideSwap said Blockstream later traced the problem to a bug in Elements, the software underpinning Liquid. A complete public technical post-mortem had not been released at the time of verification.

That distinction is important. A stolen key would represent one type of security failure, while a software flaw that allows an apparently authorised transaction to produce an unintended result raises different questions about testing and safeguards.

Will the Bitcoin be returned?

The people behind the withdrawal later said they would return most of the funds once the vulnerability was fixed and affected nodes were patched. The Block reported that Blockstream subsequently sent a signed message indicating its bridge nodes had been patched and that the funds were safe to return. At the latest verified point, however, the roughly 4,000 BTC had not been publicly confirmed as returned.

What this means for African users

For African users, the immediate concern is less about Bitcoin’s market price and more about infrastructure risk. Anyone using a wallet, exchange or service that depends on Liquid could face temporary restrictions while L-BTC deposits, withdrawals or bridge functions are disrupted.

The incident also shows that services built around Bitcoin can introduce additional software and operational risks that are separate from the security of Bitcoin itself.

Our Recommendation

The $320 million should not yet be described as a confirmed permanent loss. Important questions about the precise technical cause and whether all affected funds will be returned remain unresolved.

Liquid and Blockstream should ultimately provide a detailed post-incident report explaining what failed, how the problem was fixed and what safeguards have been introduced.

Until normal operations are officially confirmed, users and businesses relying on Liquid should follow verified service updates rather than assume that deposits, withdrawals or bridge functions have resumed.