Liquid Network, the bitcoin sidechain built by Blockstream, presents itself as a federation of more than 80 companies. In practice, the number of firms that can actually move the bitcoin backing the network's L-BTC token is far smaller: 15. Among the identified functionaries are Blockstream itself and Nym Technologies. That gap between nominal governance and operational control became the centre of attention after an incident on September 6 that stripped the federation's reserve of nearly all its holdings.
The 15 functionaries operate under an 11-of-15 multisignature scheme, meaning any withdrawal requires eleven of the fifteen authorised signers to approve it. On September 6, that threshold was met for a transaction releasing 3,996 BTC — roughly 95% of the federation's reserve — to a single address. The reserve, which had stood at approximately 4,200 BTC, fell to just 197 BTC in one operation.
Funds returned, but questions remain
Those behind the withdrawal later returned about 3,400 BTC, worth close to USD 285 million at the time, to the federation's reserve address. The party responsible for the transaction referred to themselves using the term "hackers éticos." The identity behind the transaction and the precise technical route by which the withdrawal cleared the federation's controls have not been disclosed.
The episode has drawn attention to the mechanics of Liquid's whitelist system, known as PAK, which governs which addresses can receive withdrawn bitcoin. Changing a whitelist entry takes three days under normal procedure. The network also has an emergency recovery mechanism with a waiting period of about 56 days, but it was never activated during the incident.
Wallets and exchanges affected
The disruption reached companies built on top of Liquid. SideSwap, a federation member that allows conversion of L-BTC to BTC through a whitelisted address, was affected by the freeze on network activity. Users of Aqua Wallet had their funds temporarily frozen as a result. At the time of reporting, the Liquid Network remained paused, preventing holders from redeeming L-BTC for real bitcoin.
The federation includes well-known names in the bitcoin industry such as Ledger, BullBitcoin, Bitfinex, Breez, JAN3 and Mempool, though membership in the federation does not equate to signing authority. Only the 15 functionaries hold that power under the current structure.
A pending overhaul
Blockstream and the federation have been working on an update called Dynamic Federations, which would expand the pool of signers beyond the current 15 and adjust how emergency keys are managed. The September 6 incident is likely to add urgency to that work, given how concentrated control proved to be over a network whose membership numbers in the dozens but whose signing power rests with a fraction of that group.
