White-Hat Hacker Withdraws 4,000 Bitcoin From Liquid Network, or 95% of Reserves

A security breach at Bitcoin sidechain Liquid Network resulted in the withdrawal of 4,000 Bitcoin worth about $320 million.

The withdrawal was carried out by an entity claiming to be a white-hat hacker, The Block reported on September 6. Before the incident, Liquid held about 4,200 Bitcoin in reserves, meaning the withdrawn amount was roughly 95% of the total.

Liquid said the funds were withdrawn through the SideSwap PAK, or Peg-out Authorization Key, which is used to authorize Bitcoin withdrawals. The company said there was no sign that the key or any other keys had been compromised, but it did not disclose the specific vulnerability that was exploited. A message attached to the Bitcoin transactions linked to the incident said, "We are a white hat. Contact us on-chain."

Blockstream, Liquid's technology provider, is attempting to contact the entity using an on-chain signed message. The party's identity, and whether the withdrawn Bitcoin will be returned, remain unconfirmed.

After the incident, Liquid temporarily disabled its bridge nodes to prevent new transactions from being submitted to the network. It also notified cryptocurrency exchanges of the breach, and some exchanges have suspended or plan to suspend deposits and withdrawals of LBTC, Liquid's Bitcoin-pegged token. Liquid said the sidechain is effectively paused until the issue is resolved.

Liquid said other assets issued on the network, including USDT, DePix and real-world assets, were not directly affected by the breach. Federation members are working to resolve the incident and restore the network, but the company did not provide a timeline for resuming operations.