The Liquid Network, a Bitcoin sidechain maintained by Blockstream, suffered a security incident on Sunday (6) that led to the withdrawal of roughly 4,000 BTC, valued at approximately $320 million, from the federation wallet backing the L-BTC token. The network was paused after the attack, and exchanges were told to suspend deposits and withdrawals of the asset while the case was investigated.

Liquid is a network running parallel to Bitcoin, created to allow faster, more confidential transfers as well as the issuance of digital assets. In practice, bitcoins are locked on the main network and represented on Liquid by L-BTC, a token backed by those BTC. The withdrawal therefore struck directly at the wallet underpinning that backing.

According to Liquid, those behind the incident identified themselves as “white hats”, a term used for ethical hackers who exploit flaws to warn projects before criminals can take advantage of them. Even so, the way the operation unfolded raised doubts in the market, since around 95% of the Bitcoin reserves reported by the network were withdrawn in a single move.

The withdrawal went through the peg-out service of SideSwap, a federation member authorised to process withdrawals from the network. Liquid said the key used in that process was not compromised, and SideSwap likewise said its systems had not been breached. The suspicion, according to information released so far, is a flaw in Elements, the open-source software used by Liquid.

In a transaction on the Bitcoin blockchain, those responsible left a message saying they were “white hats” and asked for on-chain contact. Blockstream and the hackers then began exchanging signed messages via Bitcoin transactions.

The case has drawn attention because, according to Liquid itself, it was not a direct theft of federation keys. The initial reading is that someone managed to create L-BTC without the corresponding Bitcoin collateral and then redeemed real BTC through an apparently valid exit from the network.

Hackers return $270 million

On Monday (7), those responsible for the incident returned 3,400 BTC, about $269 million to $270 million, to the Liquid federation wallet. The return recovered roughly 85% of the withdrawn funds.

The transfer came after Blockstream sent a signed message stating that Liquid's bridge nodes had been patched and that the funds could now be safely returned. Before that, the hackers had said the network remained at risk and that they would transfer the money back once the flaw was fixed and the nodes updated.

Despite the partial return, around 598.5 BTC, valued at approximately $47 million, still remain at the address linked to the withdrawal. Liquid has not yet said whether this amount will be returned, how it intends to cover any resulting shortfall in L-BTC backing, or when the network and its peg services will resume normal operation.

The classification of those responsible as “white hats” also remains under debate. Charles Guillemet, chief technology officer at Ledger, questioned that version after the partial return of funds, saying that if a reward had been negotiated to keep part of the funds, the case would resemble extortion more than ethical hacking.

Blockstream said a software update had been implemented and that federation members are preparing for a coordinated relaunch of the network. Other assets issued on Liquid, such as USDT, DePix and real-world assets, are not thought to have been directly affected by the incident, although wallets and operations involving L-BTC were affected by the pause.

The episode underlines a sensitive point for networks that function as bridges or parallel layers to Bitcoin: even when the main network is not affected, flaws in conversion, custody or backing mechanisms can move billions in value and put user trust at risk. In Liquid's case, the return of most of the bitcoins reduces the immediate loss, but questions remain open about the flaw, the remaining funds and the full resumption of operations.

Looking for a way to boost your returns? Mercado Bitcoin's Tokenised Fixed Income is the answer: up to 18% annual return, controlled risk, and the security your money deserves. Find out more!