Purported White Hats Pull $320M From Liquid Reserve, Putting L-BTC Peg Under Scrutiny

Liquid’s halt turned on the part of the network that matters most to L-BTC holders: the reserve mechanism behind its stated 1:1 Bitcoin peg. Nearly 4,000 BTC left the federation wallet through the peg-out path, while Liquid said the federation’s keys had not been compromised.

Liquid Network offers faster Bitcoin settlement and issues tokenised assets. Still, the incident that halted the sidechain occurred at a more centralised part of its design: the federation-operated mechanism connecting L-BTC with the Bitcoin held in reserve.

We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.What we know so far is that the funds…

How the Peg-Out Mechanism Became the Failure Point

Under Liquid’s documented model, each L-BTC is intended to be backed by an equivalent amount of BTC held in the federation wallet. Moving assets in the opposite direction requires destroying L-BTC before the federation releases BTC through a peg-out.

That mechanism became the critical point of failure on Sunday when actors described as “purported white-hat hackers” withdrew approximately 4,000 BTC, worth about $320 million, from the Liquid Federation wallet, according to the network’s statement.

The wallet held about 4,200 BTC before the incident. The funds were withdrawn through the Peg-out Authorisation Key operated by settlement platform SideSwap.

Liquid said the key itself, and the network’s other keys, had not been compromised. A preliminary account instead points to a software vulnerability affecting the L-BTC issuance and redemption process.

Unbacked L-BTC was allegedly created and then presented for a peg-out, allowing the corresponding BTC to leave the federation reserve. Liquid had not released an independent technical post-mortem confirming that sequence by September 7.

Federation members temporarily turned off the bridge nodes, preventing new transactions from being submitted and effectively pausing the sidechain.

Exchanges were notified and had suspended, or were preparing to suspend, L-BTC deposits and withdrawals.

The Reserve Question Remains

Liquid said other assets issued on the network, including USDT, DePix and real-world assets, were not affected by the security incident.

However, turning off the bridge nodes also interrupted the network that transfers those assets. The apparent mechanism is closer to the 2022 Wormhole incident, which involved unbacked wrapped assets, than to the compromise of validator keys behind the Ronin Bridge attack.

It also resembles Nomad’s failure at the message-verification layer, although Nomad operated as a permissionless cross-chain bridge rather than a federated Bitcoin sidechain.

The actors reportedly offered to return most of the BTC after the vulnerability was fixed, but no confirmed repayment had been reported by September 7.

Available accounts suggest this may be the first publicly known incident of this scale to drain almost the entire Liquid Federation reserve through the L-BTC peg-out mechanism.

However, a post-mortem is needed to confirm that. The immediate financial effect therefore extends beyond the federation wallet. With about 4,000 of 4,200 BTC removed, the reserve supporting Liquid’s stated 1:1 L-BTC peg was left almost entirely depleted.